admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'TR-2113_New_Kerberoasting_detections' of https://github.com/splunk/security_content into TR-2113_New_Kerberoasting_detections

Browse Source
This commit is contained in:
gowthamarajr
2022-06-24 10:17:56 -04:00
parent 0f23640526 6f30962fd6
commit fd78ddcb6f
378 changed files with 6678 additions and 4937 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml
+80
View File
@@ -0,0 +1,80 @@
name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline
id: 273df2f7-643a-451a-8d4d-637e39eadc87
version: 1
date: '2022-05-27'
author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
type: Baseline
datamodel:
- Splunk_Audit
description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting.
The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior.
The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here:
https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps
unless the same account of training this model will be used to perform inference using this model for anomaly
detection.'
search: '| tstats sum(Search_Activity.total_run_time) as run_time, count
FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="")
AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now)
AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *",
"*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*"))
AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user)
BY _time, Search_Activity.user span=1h
| fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true
by Search_Activity.user into "risky_command_abuse" '
how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky
SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/
and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might
take significant computing resources. It might require dedicated search head. The underlined machine learning
algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as
max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction
parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply
Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points
to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better
suit users' violation policy and their usage environment.
known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density
function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
references:
- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Web Server
cis20:
- CIS 3
- CIS 6
confidence: 40
cve:
- CVE-2022-32154
context:
- Source: Endpoint
dataset:
- https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
impact: 50
kill_chain_phases:
- Actions on Objectives
message: ML model "risky_command_abuse" training is completed.
mitre_attack_id:
- T1059
nist:
- DE.AE
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Search_Activity.search
- Search_Activity.total_run_time
- Search_Activity.user
- Search_Activity.search_type
risk_score: 20
security_domain: audit
detections:
- Splunk Command and Scripting Interpreter Risky SPL MLTK
bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py
+1
View File
@@ -24,6 +24,7 @@ class DataModel(enum.Enum):
Endpoint_Filesystem = 14
Endpoint_Registry = 15
Risk = 16
Splunk_Audit = 17
class SecurityContentType(enum.Enum):
detections = 1
bin/docker_detection_tester/detection_testing_execution.py
+5 -15
View File
@@ -29,9 +29,10 @@ import requests.packages.urllib3
from docker.client import DockerClient
from requests import get
import modules.new_arguments2
from modules import (container_manager, new_arguments2,
testing_service, validate_args)
testing_service, validate_args, utils)
from modules.github_service import GithubService
from modules.validate_args import validate, validate_and_write, ES_APP_NAME
@@ -56,17 +57,6 @@ MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING = 2
def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False)->None:
if os.path.exists(destination_file) and overwrite_file is False:
print(f"[{destination_file}] already exists...using cached version")
return
print(f"downloading to [{destination_file}]")
file_to_download = requests.get(url, stream=True)
with open(destination_file, "wb") as output:
for piece in file_to_download.iter_content(chunk_size=(1024*1024)):
output.write(piece)
def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tuple[str,None] = None, splunkbase_password:tuple[str,None] = None, mock:bool = False, target_directory:str = "apps") -> str:
if mock is True:
target_directory = os.path.join("prior_config", target_directory)
@@ -128,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl
path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable
base_name = path_after_host.rpartition('/')[-1] #just get the file name
dest_path = os.path.join(target_directory, base_name) #write the whole path
download_file_from_http(http_path, dest_path)
utils.download_file_from_http(http_path, dest_path, verbose_print=True)
#we need to update the local path because this is used to copy it into the container later
item['local_path'] = dest_path
#Remove the HTTP Path, we will use the local_path instead
@@ -341,7 +331,7 @@ def main(args: list[str]):
start_datetime = datetime.now()
action, settings = modules.new_arguments2.parse(args)
action, settings = new_arguments2.parse(args)
if action == "configure":
# Done, nothing else to do
print("Configuration complete!")
bin/docker_detection_tester/modules/splunk_container.py
+11 -1
View File
@@ -455,8 +455,18 @@ class SplunkContainer:
#pdb.set_trace()
# Fill in all the "Empty" fields with default values. Otherwise, we will not be able to
# process the result correctly.
detection_to_test.replace("security_content/tests", "security_content/detections")
try:
test_file_obj = testing_service.load_file(os.path.join("security_content/", detection_to_test))
if 'file' not in test_file_obj:
raise Exception(f"'file' field not found in {detection_to_test}")
except:
test_file_obj['file'] = detection_to_test.replace("tests/", "").replace(".test.yml", ".yml")
print(f"Error getting the detection file associated with the test file. We will try our best to convert it: {detection_to_test}-->{test_file_obj['file']}")
self.synchronization_object.addError(
{"detection_file": detection_to_test,
{"detection_file": test_file_obj['file'],
"detection_error": str(e)}, duration_string = datetime.timedelta(seconds=round(timeit.default_timer() - current_test_start_time))
bin/docker_detection_tester/modules/testing_service.py
+4 -5
View File
@@ -9,6 +9,7 @@ import os
import time
import requests
from modules.DataManipulation import DataManipulation
from modules import utils
from modules import splunk_sdk
import timeit
from typing import Union, Tuple
@@ -103,12 +104,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa
data_upload_index = splunk_sdk.DEFAULT_DATA_INDEX
indices_to_delete.add(data_upload_index)
r = requests.get(url, allow_redirects=True)
target_file = os.path.join(folder_name, attack_data['file_name'])
with open(target_file, 'wb') as target:
target.write(r.content)
#print(target_file)
utils.download_file_from_http(url, target_file)
# Update timestamps before replay
bin/docker_detection_tester/modules/utils.py
+23
View File
@@ -0,0 +1,23 @@
import os
import requests
def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size:int=1024*1024, verbose_print:bool=False)->None:
if os.path.exists(destination_file) and overwrite_file is False:
print(f"[{destination_file}] already exists...using cached version")
return
if verbose_print:
print(f"downloading to [{destination_file}]...",end="")
try:
file_to_download = requests.get(url, stream=True)
if file_to_download.status_code != 200:
if verbose_print:
print("FAILED")
raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}")
with open(destination_file, "wb") as output:
for piece in file_to_download.iter_content(chunk_size=chunk_size):
output.write(piece)
except Exception as e:
if verbose_print:
print("FAILED")
raise e
bin/docker_detection_tester/modules/validate_args.py
+74 -68
View File
@@ -52,13 +52,13 @@ setup_schema = {
"additionalProperties": False,
"properties": {
"app_number": {
"type": ["integer","null"]
"type": ["integer", "null"]
},
"app_version": {
"type": ["string","null"]
"type": ["string", "null"]
},
"local_path": {
"type": ["string","null"]
"type": ["string", "null"]
},
"http_path": {
"type": ["string", "null"]
@@ -66,71 +66,36 @@ setup_schema = {
},
"anyOf": [
{"required": ["local_path"]},
{"required": ["http_path"] },
{"required": ["app_number", "app_version"] },
{"required": ["http_path"]},
{"required": ["app_number", "app_version"]},
]
}
},
"default": {
ES_APP_NAME : {
ES_APP_NAME: {
"app_number": 3449,
"app_version": None,
"local_path": None
},
#The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
# The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz"
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "2.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz"
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
@@ -138,25 +103,65 @@ setup_schema = {
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "2.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz"
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz"
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
},
}
},
@@ -227,9 +232,9 @@ setup_schema = {
"type": "array",
"items": {
"type": "string",
"enum": ["endpoint", "cloud", "network","web","application", "experimental"]
"enum": ["endpoint", "cloud", "network", "web", "application", "experimental"]
},
"default": ["endpoint", "cloud", "network","web", "application"]
"default": ["endpoint", "cloud", "network", "web", "application"]
},
"types": {
@@ -252,7 +257,7 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]:
raise(e)
def check_dependencies(settings: dict, skip_password_accessibility_check:bool=True) -> bool:
def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool:
# Check complex mode dependencies
error_free = True
@@ -268,20 +273,19 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr
print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr)
error_free = False
# Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed
if skip_password_accessibility_check:
pass
elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False:
print("\n\n******************************************************\n\n")
if settings['splunk_app_password'] is not None:
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\
"and provided a password in the config file. We will NOT print this password to\n"\
"stdout. Look in the config file for this password.",file=sys.stderr)
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and provided a password in the config file. We will NOT print this password to\n"
"stdout. Look in the config file for this password.", file=sys.stderr)
else:
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"\
"to True for you. Otherwise, interactive mode login would be impossible.",file=sys.stderr)
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
"to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr)
settings['show_splunk_app_password'] = True
print("\n\n******************************************************\n\n")
@@ -289,7 +293,7 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr
return error_free
def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]:
def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
closeFile = False
if output_file is None:
import datetime
@@ -305,7 +309,8 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper,
configuration['container_password'] = None
configuration['show_splunk_app_password'] = True
validated_json, setup_schema = validate(configuration,skip_password_accessibility_check)
validated_json, setup_schema = validate(
configuration, skip_password_accessibility_check)
if validated_json == None:
print("Error in the new settings! No output file written")
else:
@@ -324,7 +329,7 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper,
return validated_json, setup_schema
def validate(configuration: dict, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]:
def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
# v = jsonschema.Draft201909Validator(argument_schema)
try:
@@ -334,7 +339,8 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) -
if len(validation_errors) == 0:
# check to make sure there were no complex errors
no_complex_errors = check_dependencies(validated_json,skip_password_accessibility_check)
no_complex_errors = check_dependencies(
validated_json, skip_password_accessibility_check)
if no_complex_errors:
return validated_json, setup_schema
else:
@@ -351,4 +357,4 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) -
except Exception as e:
print("There was an error validation the configuration: [%s]" % (
str(e)), file=sys.stderr)
return None, setup_schema
return None, setup_schema
bin/docker_detection_tester/test_config_github_actions.json
+118 -113
View File
@@ -1,114 +1,119 @@
{
"apps": {
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "2.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "2.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz"
},
"SPLUNK_ES_CONTENT_UPDATE": {
"app_number": 3449,
"app_version": null,
"local_path": null
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
}
},
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
"commit_hash": null,
"container_tag": "latest",
"detections_list": null,
"folders": [
"endpoint",
"cloud",
"network",
"web",
"application"
],
"interactive": false,
"local_base_container_name": "splunk_test_%d",
"mock": false,
"mode": "changes",
"no_interactive_failure": true,
"num_containers": 10,
"persist_security_content": false,
"pr_number": null,
"reuse_image": true,
"show_splunk_app_password": false,
"splunk_app_password": null,
"splunk_container_apps_directory": "/opt/splunk/etc/apps",
"splunkbase_password": null,
"splunkbase_username": null,
"types": [
"Anomaly",
"Hunting",
"TTP"
]
}
"apps": {
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
},
"SPLUNK_ES_CONTENT_UPDATE": {
"app_number": 3449,
"app_version": null,
"local_path": null
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
}
},
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
"commit_hash": null,
"container_tag": "latest",
"detections_list": null,
"folders": [
"endpoint",
"cloud",
"network",
"web",
"application"
],
"interactive": false,
"local_base_container_name": "splunk_test_%d",
"mock": false,
"mode": "changes",
"no_interactive_failure": true,
"num_containers": 10,
"persist_security_content": false,
"pr_number": null,
"reuse_image": true,
"show_splunk_app_password": false,
"splunk_app_password": null,
"splunk_container_apps_directory": "/opt/splunk/etc/apps",
"splunkbase_password": null,
"splunkbase_username": null,
"types": [
"Anomaly",
"Hunting",
"TTP"
]
}
detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml
+62
View File
@@ -0,0 +1,62 @@
name: Splunk Command and Scripting Interpreter Delete Usage
id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04
version: 1
date: '2022-05-27'
author: Michael Haag, Splunk
type: Anomaly
datamodel:
- Splunk_Audit
description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
| `drop_dm_object_name(Search_Activity)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `splunk_command_and_scripting_interpreter_delete_usage_filter`'
how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/.
known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed.
references:
- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Web Server
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32154
confidence: 30
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: $user$ executed the 'delete' command, if this is unexpected it should be reviewed.
mitre_attack_id:
- T1059
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Search_Activity.search
- Search_Activity.info
- Search_Activity.total_run_time
- Search_Activity.user
- Search_Activity.savedsearch_name
- Search_Activity.search_type
risk_score: 27
security_domain: audit
detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml
+67
View File
@@ -0,0 +1,67 @@
name: Splunk Command and Scripting Interpreter Risky Commands
id: 1cf58ae1-9177-40b8-a26c-8966040f11ae
version: 1
date: '2022-05-23'
author: Michael Haag, Splunk
type: Hunting
datamodel:
- Splunk_Audit
description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include -
Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga.
A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run.
During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity.
In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
| `drop_dm_object_name(Search_Activity)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `splunk_command_and_scripting_interpreter_risky_commands_filter`'
how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: False positives will be present until properly filtered by Username and search name.
references:
- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Web Server
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 40
cve:
- CVE-2022-32154
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
impact: 50
kill_chain_phases:
- Actions on Objectives
message: A risky Splunk command has ran by $user$ and should be reviewed.
mitre_attack_id:
- T1059
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Search_Activity.search
- Search_Activity.info
- Search_Activity.total_run_time
- Search_Activity.user
- Search_Activity.savedsearch_name
- Search_Activity.search_type
risk_score: 20
security_domain: audit
detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml
+75
View File
@@ -0,0 +1,75 @@
name: Splunk Command and Scripting Interpreter Risky SPL MLTK
id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca
version: 1
date: '2022-05-27'
author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
type: Anomaly
datamodel:
- Splunk_Audit
description: 'This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command
and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user
has run searches containing risky SPL from this list
https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga
with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search
uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)'
search: '| tstats sum(Search_Activity.total_run_time) AS run_time,
values(Search_Activity.search) as searches, count
FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="")
AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now)
AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *",
"*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*"))
AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user)
BY _time, Search_Activity.user span=1h
| apply risky_command_abuse
| fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time)
| rename IsOutlier(run_time) as isOutlier, _time as timestamp
| where isOutlier>0.5
| `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`'
how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/
and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model
needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run.
Please note that the current search only finds matches exactly one space between separator bar and risky commands.
known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density
function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
references:
- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Web Server
cis20:
- CIS 3
- CIS 6
confidence: 40
cve:
- CVE-2022-32154
context:
- Source:Endpoint
dataset:
- https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
impact: 50
kill_chain_phases:
- Actions on Objectives
message: Abnormally long run time for risk SPL command seen by user $(Search_Activity.user).
mitre_attack_id:
- T1059
nist:
- DE.AE
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Search_Activity.search
- Search_Activity.total_run_time
- Search_Activity.user
- Search_Activity.search_type
risk_score: 20
security_domain: audit
detections/application/splunk_digital_certificates_infrastructure_version.yml
+51
View File
@@ -0,0 +1,51 @@
name: Splunk Digital Certificates Infrastructure Version
id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7
version: 1
date: '2022-05-26'
author: Lou Stella, Splunk
type: Hunting
datamodel: []
description: This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`'
how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: No known at this time.
references:
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32153
confidence: 100
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
impact: 50
kill_chain_phases:
- Exploitation
message: $splunk_server$ may not be properly validating TLS Certificates
mitre_attack_id:
- T1587.003
nist:
- DE.CM
observable:
- name: splunk_server
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- none
risk_score: 50
security_domain: threat
detections/application/splunk_digital_certificates_lack_of_encryption.yml
+56
View File
@@ -0,0 +1,56 @@
name: Splunk Digital Certificates Lack of Encryption
id: 386a7ebc-737b-48cf-9ca8-5405459ed508
version: 1
date: '2022-05-26'
author: Lou Stella, Splunk
type: Anomaly
datamodel: []
description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities.
search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`'
how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: None at this time
references:
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32151
confidence: 80
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log
impact: 25
kill_chain_phases:
- Exploitation
message: $hostname$ is not using TLS when forwarding data
mitre_attack_id:
- T1587.003
nist:
- DE.CM
observable:
- name: hostname
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- group
- ssl
- sourceIp
- fwdType
- version
- hostname
risk_score: 20
security_domain: threat
detections/application/splunk_process_injection_forwarder_bundle_downloads.yml
+54
View File
@@ -0,0 +1,54 @@
name: Splunk Process Injection Forwarder Bundle Downloads
id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e
version: 1
date: '2022-05-26'
author: Lou Stella, Splunk
type: Hunting
datamodel: []
description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment.
search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`'
how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: None at this time.
references:
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32157
confidence: 70
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log
impact: 50
kill_chain_phases:
- Exploitation
message: $peer$ downloaded apps from $host$
mitre_attack_id:
- T1055
nist:
- DE.CM
observable:
- name: host
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- component
- app
- serverclass
- peer
- host
risk_score: 35
security_domain: threat
detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml
+51
View File
@@ -0,0 +1,51 @@
name: Splunk Protocol Impersonation Weak Encryption Configuration
id: 900892bf-70a9-4787-8c99-546dd98ce461
version: 1
date: '2022-05-25'
author: Lou Stella, Splunk
type: Hunting
datamodel: []
description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`'
how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration.
references:
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32151
confidence: 100
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
impact: 50
kill_chain_phases:
- Exploitation
message: $splunk_server$ may not be properly validating TLS Certificates
mitre_attack_id:
- T1001.003
nist:
- DE.CM
observable:
- name: splunk_server
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- none
risk_score: 50
security_domain: threat
detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml
+53
View File
@@ -0,0 +1,53 @@
name: Splunk protocol impersonation weak encryption selfsigned
id: c76c7a2e-df49-414a-bb36-dce2683770de
version: 1
date: '2022-05-26'
author: Rod Soto, Splunk
type: Hunting
datamodel: []
search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`'
description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates.
how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward.
references:
- https://www.splunk.com/en_us/product-security
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32152
confidence: 80
context:
- Source:Endpoint
dataset:
- https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt
impact: 50
kill_chain_phases:
- Exploitation
message: Splunk default issued certificate at $host$
mitre_attack_id:
- T1588.004
nist:
- DE.CM
observable:
- name: Hostname
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- host
- CN
- event_message
risk_score: 40
security_domain: threat
detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml
+53
View File
@@ -0,0 +1,53 @@
name: Splunk protocol impersonation weak encryption simplerequest
id: 839d12a6-b119-4d44-ac4f-13eed95412c8
version: 1
date: '2022-05-24'
author: Rod Soto, Splunk
type: Hunting
datamodel: []
search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`'
description: On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request.
how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
references:
- https://www.splunk.com/en_us/product-security
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Endpoint
cve:
- CVE-2022-32152
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 80
context:
- Source:Endpoint
dataset:
- https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt
impact: 50
kill_chain_phases:
- Exploitation
message: Failed to validate certificate on $host$
mitre_attack_id:
- T1588.004
nist:
- DE.CM
observable:
- name: Hostname
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- host
- event_message
- path
risk_score: 40
security_domain: threat
detections/cloud/aws_ecr_container_scanning_findings_high.yml
+2 -2
View File
@@ -1,7 +1,7 @@
name: AWS ECR Container Scanning Findings High
id: 62721bd2-1d82-4623-b6e6-aac170014423
version: 1
date: '2021-08-17'
date: '2022-06-21'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description
| eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time)
as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName,
as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName,
src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_high_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description
| eval phase="release" | eval severity="medium" | stats min(_time) as firstTime
max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image,
user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
detections/endpoint/office_document_executing_macro_code.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious office documen
or other malware component. It is really good practice to disable macro by default
to avoid automatically execute macro code while opening or closing a office document
files.
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
detections/endpoint/potential_password_in_username.yml
+95
View File
@@ -0,0 +1,95 @@
name: Potential password in username
id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38
version: 1
date: '2022-05-11'
author: Mikael Bjerkeland, Splunk
type: Hunting
datamodel:
- Authentication
description: This search identifies users who have entered their passwords in username
fields. This is done by looking for failed authentication attempts using usernames with a length
longer than 7 characters and a high Shannon entropy, and looks for the next successful
authentication attempt from the same source system to the same destination system
as the failed attempt.
search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src
values(Authentication.dest) AS dest count FROM datamodel=Authentication
WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user"
| `drop_dm_object_name(Authentication)`
| lookup ut_shannon_lookup word AS user
| where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1
| sort count, - ut_shannon
| eval incorrect_password=user
| eval endtime=endtime+1000
| map maxsearches=70 search="| tstats `security_content_summariesonly`
earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype
values(Authentication.src) AS src values(Authentication.dest) AS dest count
FROM datamodel=Authentication WHERE nodename=Authentication.Successful_Authentication
Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\")
earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\"
| `drop_dm_object_name(\"Authentication\")`
| `potential_password_in_username_false_positive_reduction`
| eval incorrect_password=\"$incorrect_password$\"
| eval ut_shannon=\"$ut_shannon$\"
| sort count"
| where user!=incorrect_password
| outlier action=RM count
| `potential_password_in_username_filter`'
how_to_implement: To successfully implement this search, you need to have relevant
authentication logs mapped to the Authentication data model. You also need to
have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
The detection must run with a time interval shorter than endtime+1000.
known_false_positives: Valid usernames with high entropy or source/destination system pairs
with multiple authenticating users will make it difficult to identify the real user
authenticating.
references:
- https://medium.com/@markmotig/search-for-passwords-accidentally-typed-into-the-username-field-975f1a389928
tags:
analytic_story:
- Credential Dumping
- Insider Threat
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Source:AD
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/password_in_username/linux_secure.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Potential password in username ($user$) with Shannon entropy ($ut_shannon$)
mitre_attack_id:
- T1078.003
- T1552.001
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: src
type: IP Address
role:
- Attacker
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Authentication.user
- Authentication.src
- Authentication.dest
- sourcetype
risk_score: 21
security_domain: access
investigations/rundll32_lockworkstation.yml → detections/endpoint/rundll32_lockworkstation.yml
+4 -3
View File
@@ -1,9 +1,9 @@
name: Rundll32 LockWorkStation
id: fa90f372-f91d-11eb-816c-acde48001122
version: 1
version: 2
date: '2021-08-09'
author: Teoderick Contreras, Splunk
type: Investigation
type: Anomaly
datamodel:
- Endpoint
description: This search is to detect a suspicious rundll32 commandline to lock the
@@ -46,7 +46,7 @@ tags:
role:
- Victim
- name: SourceImage
type: process name
type: Process Name
role:
- Attacker
product:
@@ -65,3 +65,4 @@ tags:
- Processes.parent_process_id
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 1
date: '2022-03-18'
version: 2
date: '2022-06-22'
author: Michael Haag, Splunk
type: Anomaly
datamodel:
@@ -29,7 +29,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND
match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
AND match_regex(process_path, /(?i)\\microsoft.net/)=false AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml
+75
View File
@@ -0,0 +1,75 @@
name: Windows Impair Defense Delete Win Defender Context Menu
id: 395ed5fe-ad13-4366-9405-a228427bdd91
version: 1
date: '2022-06-07'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
description: The search looks for the deletion of Windows Defender context menu within the registry.
This is consistent behavior with RAT malware across a fleet of endpoints. This particular
behavior is executed when an adversary gains access to an endpoint
and begins to perform execution. Usually, a batch (.bat) will be executed and multiple
registry and scheduled task modifications will occur. During triage, review parallel
processes and identify any further file modifications.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted
by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_impair_defense_delete_win_defender_context_menu_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since
it is a default security control, although it is not rare for some policies to disable
it. Although no false positives have been identified, use the provided filter macro
to tune the search.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
cis20:
- CIS 8
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log
impact: 50
kill_chain_phases:
- Delivery
message: Windows Defender context menu registry key deleted on $dest$.
mitre_attack_id:
- T1562.001
- T1562
nist:
- PR.PT
- DE.CM
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.action
risk_score: 25
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml
+75
View File
@@ -0,0 +1,75 @@
name: Windows Impair Defense Delete Win Defender Profile Registry
id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96
version: 1
date: '2022-06-07'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The search looks for the deletion of Windows Defender main profile within the registry.
This was used by RAT malware across a fleet of endpoints. This particular
behavior is typically executed when an adversary gains access to an endpoint
and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
registry and scheduled task modifications will occur. During triage, review parallel
processes and identify any further file modifications.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted
by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_impair_defense_delete_win_defender_profile_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since
it is a default security control, although it is not rare for some policies to disable
it. Although no false positives have been identified, use the provided filter macro
to tune the search.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log
impact: 80
kill_chain_phases:
- Delivery
message: Windows Defender Logger registry key set to 'disabled' on $dest$.
mitre_attack_id:
- T1562.001
- T1562
nist:
- PR.PT
- DE.CM
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.action
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml
+75
View File
@@ -0,0 +1,75 @@
name: Windows Impair Defenses Disable Win Defender Auto Logging
id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c
version: 1
date: '2022-06-07'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable.
This is consistent with RAT malware across a fleet of endpoints. This particular
behavior is typically executed when an adversary gains access to an endpoint
and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
registry and scheduled task modifications will occur. During triage, review parallel
processes and identify any further file modifications.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry
where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000"
by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_impair_defenses_disable_win_defender_auto_logging_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since
it is a default security control, although it is not rare for some policies to disable
it. Although no false positives have been identified, use the provided filter macro
to tune the search.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log
impact: 30
kill_chain_phases:
- Delivery
message: Windows Defender Logger registry key set to 'disabled' on $dest$.
mitre_attack_id:
- T1562.001
- T1562
nist:
- PR.PT
- DE.CM
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.action
risk_score: 24
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
detections/endpoint/windows_msiexec_dllregisterserver.yml
+81
View File
@@ -0,0 +1,81 @@
name: Windows MSIExec DLLRegisterServer
id: fdb59aef-d88f-4909-8369-ec2afbd2c398
version: 1
date: '2022-06-14'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
Upon triage, review parent process and capture any artifacts for further review.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_msiexec`
Processes.process IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_msiexec_dllregisterserver_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
mitre_attack_id:
- T1218.007
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 35
security_domain: endpoint
detections/endpoint/windows_msiexec_remote_download.yml
+81
View File
@@ -0,0 +1,81 @@
name: Windows MSIExec Remote Download
id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda
version: 1
date: '2022-06-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it.
During triage, review parallel processes and capture any artifacts on disk for review.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*")
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_msiexec_remote_download_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be present, filter by destination or parent process as needed.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file.
mitre_attack_id:
- T1218.007
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 35
security_domain: endpoint
detections/endpoint/windows_msiexec_spawn_discovery_command.yml
+80
View File
@@ -0,0 +1,80 @@
name: Windows MSIExec Spawn Discovery Command
id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee
version: 1
date: '2022-06-13'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies MSIExec spawning multiple discovery commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes are not common from MSIExec other than MSIExec spawning itself.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe")
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_msiexec_spawn_discovery_command_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands.
mitre_attack_id:
- T1218.007
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 35
security_domain: endpoint
detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
+80
View File
@@ -0,0 +1,80 @@
name: Windows MSIExec Unregister DLLRegisterServer
id: a27db3c5-1a9a-46df-a577-765d3f1a3c24
version: 1
date: '2022-06-14'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
Upon triage, review parent process and capture any artifacts for further review.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_msiexec`
Processes.process IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file.
mitre_attack_id:
- T1218.007
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 35
security_domain: endpoint
detections/endpoint/windows_msiexec_with_network_connections.yml
+80
View File
@@ -0,0 +1,80 @@
name: Windows MSIExec With Network Connections
id: 827409a1-5393-4d8d-8da4-bbb297c262a7
version: 1
date: '2022-06-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies MSIExec with any network connection over port 443 or 80. Typically, MSIExec does not perform network communication to the internet.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_msiexec` by _time Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| join process_id [| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id
All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ]
| table _time dest parent_process_name process_name process_path process process_id dest_port dest_ip
| `windows_msiexec_with_network_connections_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Add parent process as a filter, filter known good processes. This may be voluminous due to the join on process_id. All_Traffic does not have process_guid, yet.
known_false_positives: False positives will be present and filtering is required.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination.
mitre_attack_id:
- T1218.007
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.process_id
- Processes.process_name
- Processes.dest
- Processes.process_path
- Processes.process
- Processes.parent_process_name
- All_Traffic.process_id
- All_Traffic.dest
- All_Traffic.dest_port
- All_Traffic.dest_ip
risk_score: 35
security_domain: endpoint
detections/endpoint/winword_spawning_windows_script_host.yml
+1 -1
View File
@@ -31,7 +31,7 @@ references:
- https://attack.mitre.org/techniques/T1566/001/
tags:
analytic_story:
- Spearphishing Attachment
- Spearphishing Attachments
confidence: 100
context:
- Source:Endpoint
detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml
+2 -2
View File
@@ -1,6 +1,6 @@
name: Detect Unauthorized Assets by MAC address
id: dcfd6b40-42f9-469d-a433-2e53f7489ff4
version: 1
version: 2
date: '2017-09-13'
author: Bhavin Patel, Splunk
type: TTP
@@ -13,7 +13,7 @@ description: By populating the organization's assets within the assets_by_str.cs
associated with the source of the DHCP request is checked against the list of known
devices, and reports on those that are not found.
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Sessions
where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip
where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip
All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")`
| search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields
+ dest_mac] | `detect_unauthorized_assets_by_mac_address_filter`'
detections/network/splunk_identified_ssl_tls_certificates.yml
+57
View File
@@ -0,0 +1,57 @@
name: Splunk Identified SSL TLS Certificates
id: 620fbb89-86fd-4e2e-925f-738374277586
version: 1
date: '2022-05-25'
author: Michael Haag, Splunk
type: Hunting
datamodel: []
description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL.
search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype
| `splunk_identified_ssl_tls_certificates_filter`'
how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized.
references:
- https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Proxy
cis20:
- CIS 3
- CIS 5
- CIS 16
cve:
- CVE-2022-32151
- CVE-2022-32152
confidence: 70
context:
- Source:Application Log
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log
impact: 60
kill_chain_phases:
- Reconnaissance
message: The following $dest$ is using the self signed Splunk certificate.
mitre_attack_id:
- T1040
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- ssl_issuer
- ssl_subject_common_name
- ssl_subject_organization
- ssl_subject
- host
- sourcetype
risk_score: 42
security_domain: network
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.42.0"
"version": "3.43.1"
},
"author": [
{
dist/escu/default/analyticstories.conf
Vendored
+158 -16
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -17,6 +17,56 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
known_false_positives = This search may find additional path traversal exploitation attempts.
providing_technologies = []
[savedsearch://ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule]
type = detection
asset_type = Web Server
confidence = medium
explanation = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used.
how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule]
type = detection
asset_type = Web Server
confidence = medium
explanation = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.
how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
known_false_positives = False positives will be present until properly filtered by Username and search name.
providing_technologies = []
[savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule]
type = detection
asset_type = Web Server
confidence = medium
explanation = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)
how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands.
annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]}
known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
providing_technologies = []
[savedsearch://ESCU - Splunk Digital Certificates Infrastructure Version - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]}
known_false_positives = No known at this time.
providing_technologies = []
[savedsearch://ESCU - Splunk Digital Certificates Lack of Encryption - Rule]
type = detection
asset_type = endpoint
confidence = medium
explanation = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities.
how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]}
known_false_positives = None at this time
providing_technologies = []
[savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule]
type = detection
asset_type = Endpoint
@@ -27,6 +77,46 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
known_false_positives = None.
providing_technologies = []
[savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment.
how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
known_false_positives = None at this time.
providing_technologies = []
[savedsearch://ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]}
known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration.
providing_technologies = []
[savedsearch://ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates.
how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]}
known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward.
providing_technologies = []
[savedsearch://ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request.
how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]}
known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
providing_technologies = []
[savedsearch://ESCU - Splunk User Enumeration Attempt - Rule]
type = detection
asset_type = endpoint
@@ -5262,6 +5352,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021",
known_false_positives = Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Potential password in username - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt.
how_to_implement = To successfully implement this search, you need to have relevant authentication logs mapped to the Authentication data model. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The detection must run with a time interval shorter than endtime+1000.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"]}
known_false_positives = Valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating.
providing_technologies = []
[savedsearch://ESCU - Potentially malicious code on commandline - Rule]
type = detection
asset_type = Endpoint
@@ -5919,6 +6019,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218",
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Rundll32 LockWorkStation - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise.
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Rundll32 Process Creating Exe Dll Files - Rule]
type = detection
asset_type = Endpoint
@@ -7325,6 +7435,36 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [
known_false_positives = False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed.
providing_technologies = []
[savedsearch://ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
providing_technologies = []
[savedsearch://ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
providing_technologies = []
[savedsearch://ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
providing_technologies = []
[savedsearch://ESCU - Windows Indirect Command Execution Via forfiles - Rule]
type = detection
asset_type = Endpoint
@@ -9099,6 +9239,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.00
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Splunk Identified SSL TLS Certificates - Rule]
type = detection
asset_type = Proxy
confidence = medium
explanation = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL.
how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]}
known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized.
providing_technologies = []
[savedsearch://ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule]
type = detection
asset_type = Web Server
@@ -9520,7 +9670,7 @@ version = 3
references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
spec_version = 3
searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Windows Hunting System Account Targeting Lsass - Rule", "ESCU - Windows Non-System Account Targeting Lsass - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Potential password in username - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Windows Hunting System Account Targeting Lsass - Rule", "ESCU - Windows Non-System Account Targeting Lsass - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
@@ -9973,7 +10123,7 @@ version = 1
references = ["https://www.imperva.com/learn/application-security/insider-threats/", "https://www.cisa.gov/defining-insider-threats", "https://www.code42.com/glossary/types-of-insider-threats/", "https://github.com/Insider-Threat/Insider-Threat", "https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}]
spec_version = 3
searches = ["ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"]
searches = ["ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Potential password in username - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"]
description = Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.
narrative = Insider Threats are best defined by CISA: "Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs." An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider.
@@ -10327,7 +10477,7 @@ version = 1
references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
@@ -10469,7 +10619,7 @@ version = 1
references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}]
spec_version = 3
searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"]
searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"]
description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.
narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \
As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \
@@ -10487,7 +10637,7 @@ version = 1
references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
spec_version = 3
searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule"]
searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.
@@ -10872,7 +11022,7 @@ version = 1
references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule", "ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule", "ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others
narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
@@ -10965,7 +11115,7 @@ version = 1
references = ["https://attack.mitre.org/techniques/T1112/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
spec_version = 3
searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"]
searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule", "ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule", "ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"]
description = Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner.
narrative = Windows Registry is one of the powerful and yet still mysterious Windows features that can tweak or manipulate Windows policies and low-level configuration settings. Because of this capability, most malware, adversaries or threat actors abuse this hierarchical database to do their malicious intent on a targeted host or network environment. In these cases, attackers often use tools to create or modify registry in ways that are not typical for most environments, providing opportunities for detection.
@@ -11371,13 +11521,5 @@ known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Rundll32 LockWorkStation - Response Task]
type = investigation
explanation = none
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
### END RESPONSE TASKS ###
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 8166
build = 8439
[triggers]
reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
[launcher]
author = Splunk
version = 3.42.0
version = 3.43.1
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.42.0
version = 3.43.1
dist/escu/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/macros.conf
Vendored
+70 -2
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -9,10 +9,46 @@
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_command_and_scripting_interpreter_delete_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_command_and_scripting_interpreter_risky_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_command_and_scripting_interpreter_risky_spl_mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_digital_certificates_infrastructure_version_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_digital_certificates_lack_of_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_dos_via_malformed_s2s_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_process_injection_forwarder_bundle_downloads_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_protocol_impersonation_weak_encryption_configuration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_protocol_impersonation_weak_encryption_selfsigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_protocol_impersonation_weak_encryption_simplerequest_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_user_enumeration_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2061,6 +2097,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[potential_password_in_username_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[potentially_malicious_code_on_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2317,6 +2357,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_lockworkstation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_process_creating_exe_dll_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2869,6 +2913,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_delete_win_defender_context_menu_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_delete_win_defender_profile_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defenses_disable_win_defender_auto_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_indirect_command_execution_via_forfiles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3545,6 +3601,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_identified_ssl_tls_certificates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3794,6 +3854,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
definition = index=_internal sourcetype=splunkd_ui_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[potential_password_in_username_false_positive_reduction]
definition = search *
description = Add customer specific known false positives to the map command used in detection - Potential password in username
[potentially_malicious_code_on_cmdline_tokenize_score]
definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0)
description = Performs the tokenization and application of the malicious commandline classifier
@@ -3863,7 +3927,7 @@ definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new provisioning activities
[printservice]
definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
definition = source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[process_bitsadmin]
@@ -4071,6 +4135,10 @@ description = This macro is a list of AWS event names associated with security g
definition = index=signals
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunk_python]
definition = index=_internal sourcetype=splunk_python
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd]
definition = index=_internal sourcetype=splunkd
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
dist/escu/default/savedsearches.conf
Vendored
+644 -43
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -52,6 +52,206 @@ realtime_schedule = 0
is_visible = false
search = `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`
[ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule]
action.escu = 0
action.escu.enabled = 1
description = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
action.escu.data_models = ["Splunk_Audit"]
action.escu.eli5 = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used.
action.escu.how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/.
action.escu.known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed.
action.escu.creation_date = 2022-05-27
action.escu.modification_date = 2022-05-27
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = $user$ executed the 'delete' command, if this is unexpected it should be reviewed.
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`
[ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule]
action.escu = 0
action.escu.enabled = 1
description = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
action.escu.data_models = ["Splunk_Audit"]
action.escu.eli5 = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.
action.escu.how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = False positives will be present until properly filtered by Username and search name.
action.escu.creation_date = 2022-05-23
action.escu.modification_date = 2022-05-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = A risky Splunk command has ran by $user$ and should be reviewed.
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`
[ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule]
action.escu = 0
action.escu.enabled = 1
description = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)
action.escu.mappings = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]}
action.escu.data_models = ["Splunk_Audit"]
action.escu.eli5 = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)
action.escu.how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands.
action.escu.known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
action.escu.creation_date = 2022-05-27
action.escu.modification_date = 2022-05-27
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = Abnormally long run time for risk SPL command seen by user $(Search_Activity.user).
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 6"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`
[ESCU - Splunk Digital Certificates Infrastructure Version - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = No known at this time.
action.escu.creation_date = 2022-05-26
action.escu.modification_date = 2022-05-26
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Digital Certificates Infrastructure Version - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates
action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Digital Certificates Infrastructure Version - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32153"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`
[ESCU - Splunk Digital Certificates Lack of Encryption - Rule]
action.escu = 0
action.escu.enabled = 1
description = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities.
action.escu.how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = None at this time
action.escu.creation_date = 2022-05-26
action.escu.modification_date = 2022-05-26
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Digital Certificates Lack of Encryption - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = $hostname$ is not using TLS when forwarding data
action.risk.param._risk = [{"risk_object_field": "hostname", "risk_object_type": "system", "risk_score": 20}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Digital Certificates Lack of Encryption - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32151"], "impact": 25, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"], "observable": [{"name": "hostname", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`
[ESCU - Splunk DoS via Malformed S2S Request - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -98,6 +298,166 @@ realtime_schedule = 0
is_visible = false
search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`
[ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
action.escu = 0
action.escu.enabled = 1
description = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment.
action.escu.how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = None at this time.
action.escu.creation_date = 2022-05-26
action.escu.modification_date = 2022-05-26
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = $peer$ downloaded apps from $host$
action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 35}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32157"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`
[ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule]
action.escu = 0
action.escu.enabled = 1
description = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration.
action.escu.creation_date = 2022-05-25
action.escu.modification_date = 2022-05-25
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates
action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32151"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`
[ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule]
action.escu = 0
action.escu.enabled = 1
description = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates.
action.escu.how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward.
action.escu.creation_date = 2022-05-26
action.escu.modification_date = 2022-05-26
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = Splunk default issued certificate at $host$
action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`
[ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule]
action.escu = 0
action.escu.enabled = 1
description = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request.
action.escu.how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
action.escu.creation_date = 2022-05-24
action.escu.modification_date = 2022-05-24
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = Failed to validate certificate on $host$
action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`
[ESCU - Splunk User Enumeration Attempt - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -537,8 +897,8 @@ action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.creation_date = 2022-06-21
action.escu.modification_date = 2022-06-21
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule
action.escu.search_type = detection
@@ -572,7 +932,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`
[ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
action.escu = 0
@@ -652,7 +1012,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`
[ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
action.escu = 0
@@ -20635,8 +20995,8 @@ action.escu.data_models = ["Endpoint"]
action.escu.eli5 = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
action.escu.known_false_positives = Limited false positives will be present, however, tune as necessary.
action.escu.creation_date = 2021-09-09
action.escu.modification_date = 2021-09-09
action.escu.creation_date = 2022-06-01
action.escu.modification_date = 2022-06-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - MSHTML Module Load in Office Product - Rule
action.escu.search_type = detection
@@ -20670,7 +21030,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`
search = `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`
[ESCU - MSI Module Loaded by Non-System Binary - Rule]
action.escu = 0
@@ -21696,7 +22056,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`
search = `sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`
[ESCU - Office Document Spawned Child Process To Download - Rule]
action.escu = 0
@@ -22517,6 +22877,46 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`
[ESCU - Potential password in username - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"]}
action.escu.data_models = ["Authentication"]
action.escu.eli5 = This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt.
action.escu.how_to_implement = To successfully implement this search, you need to have relevant authentication logs mapped to the Authentication data model. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The detection must run with a time interval shorter than endtime+1000.
action.escu.known_false_positives = Valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating.
action.escu.creation_date = 2022-05-11
action.escu.modification_date = 2022-05-11
action.escu.confidence = high
action.escu.full_search_name = ESCU - Potential password in username - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Credential Dumping", "Insider Threat"]
action.risk = 1
action.risk.param._risk_message = Potential password in username ($user$) with Shannon entropy ($ut_shannon$)
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 21}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 21}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Potential password in username - Rule
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Insider Threat"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Source:AD", "Stage:Credential Access"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" | `drop_dm_object_name(Authentication)` | lookup ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon | eval incorrect_password=user | eval endtime=endtime+1000 | map maxsearches=70 search="| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication WHERE nodename=Authentication.Successful_Authentication Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` | `potential_password_in_username_false_positive_reduction` | eval incorrect_password=\"$incorrect_password$\" | eval ut_shannon=\"$ut_shannon$\" | sort count" | where user!=incorrect_password | outlier action=RM count | `potential_password_in_username_filter`
[ESCU - Potentially malicious code on commandline - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -25432,6 +25832,46 @@ realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`
[ESCU - Rundll32 LockWorkStation - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-09
action.escu.modification_date = 2021-08-09
action.escu.confidence = high
action.escu.full_search_name = ESCU - Rundll32 LockWorkStation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Ransomware"]
action.risk = 1
action.risk.param._risk_message = process $process_name$ with cmdline $process$ in host $dest$
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "SourceImage", "threat_object_type": "process name"}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Rundll32 LockWorkStation - Rule
action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process Name"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`
[ESCU - Rundll32 Process Creating Exe Dll Files - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -27245,7 +27685,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`
search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`
[ESCU - Spoolsv Suspicious Process Access - Rule]
action.escu = 0
@@ -28305,8 +28745,8 @@ action.escu.data_models = ["Endpoint"]
action.escu.eli5 = This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution.
action.escu.how_to_implement = his detection relies on sysmon logs with the Event ID 22, DNS Query.
action.escu.known_false_positives = Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
action.escu.creation_date = 2022-01-19
action.escu.modification_date = 2022-01-19
action.escu.creation_date = 2022-06-01
action.escu.modification_date = 2022-06-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious Process With Discord DNS Query - Rule
action.escu.search_type = detection
@@ -28334,7 +28774,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer process_path | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`
search = `sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`
[ESCU - Suspicious Reg exe Process - Rule]
action.escu = 0
@@ -29961,8 +30401,8 @@ action.escu.data_models = ["Endpoint"]
action.escu.eli5 = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-04-19
action.escu.modification_date = 2021-04-19
action.escu.creation_date = 2022-06-01
action.escu.modification_date = 2022-06-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule
action.escu.search_type = detection
@@ -29996,7 +30436,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`
search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`
[ESCU - Wermgr Process Create Executable File - Rule]
action.escu = 0
@@ -31680,6 +32120,126 @@ realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`
[ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule]
action.escu = 0
action.escu.enabled = 1
description = The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
action.escu.known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
action.escu.creation_date = 2022-06-07
action.escu.modification_date = 2022-06-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Windows Defender context menu registry key deleted on $dest$.
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter`
[ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule]
action.escu = 0
action.escu.enabled = 1
description = The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
action.escu.known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
action.escu.creation_date = 2022-06-07
action.escu.modification_date = 2022-06-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$.
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`
[ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule]
action.escu = 0
action.escu.enabled = 1
description = The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
action.escu.known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
action.escu.creation_date = 2022-06-07
action.escu.modification_date = 2022-06-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$.
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`
[ESCU - Windows Indirect Command Execution Via forfiles - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -31787,8 +32347,8 @@ If used by a developer, typically this will be found with multiple command-line
During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
action.escu.known_false_positives = Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed.
action.escu.creation_date = 2021-11-12
action.escu.modification_date = 2021-11-12
action.escu.creation_date = 2022-06-01
action.escu.modification_date = 2022-06-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil Credential Theft - Rule
action.escu.search_type = detection
@@ -31825,7 +32385,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`
search = `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`
[ESCU - Windows InstallUtil in Non Standard Path - Rule]
action.escu = 0
@@ -34017,7 +34577,7 @@ action.escu.full_search_name = ESCU - Winword Spawning Windows Script Host - Rul
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Spearphishing Attachment"]
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -34028,7 +34588,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -38017,7 +38577,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter`
search = | tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter`
[ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule]
action.escu = 0
@@ -39256,6 +39816,46 @@ realtime_schedule = 0
is_visible = false
search = `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`
[ESCU - Splunk Identified SSL TLS Certificates - Rule]
action.escu = 0
action.escu.enabled = 1
description = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL.
action.escu.how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
action.escu.known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized.
action.escu.creation_date = 2022-05-25
action.escu.modification_date = 2022-05-25
action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Identified SSL TLS Certificates - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = The following $dest$ is using the self signed Splunk certificate.
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Identified SSL TLS Certificates - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Application Log"], "cve": ["CVE-2022-32151", "CVE-2022-32152"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`
[ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -40954,6 +41554,28 @@ disabled = true
is_visible = false
search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process
[ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = support
action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline
description = This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection.
action.escu.creation_date = 2022-05-27
action.escu.modification_date = 2022-05-27
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.escu.data_models = ["Splunk_Audit"]
cron_schedule = 0 * * * *
enableSched = 1
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
schedule_window = auto
action.escu.providing_technologies = []
action.escu.eli5 = This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection.
action.escu.how_to_implement = The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment.
disabled = true
is_visible = false
search = | tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true by Search_Activity.user into "risky_command_abuse"
[ESCU - Systems Ready for Spectre-Meltdown Windows Patch]
action.escu = 0
action.escu.enabled = 1
@@ -42011,27 +42633,6 @@ schedule_window = auto
is_visible = false
search = | tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search http_method, "POST" | search src=$src$
[ESCU - Rundll32 LockWorkStation - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - Rundll32 LockWorkStation - Response Task
description = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise.
action.escu.creation_date = 2021-08-09
action.escu.modification_date = 2021-08-09
action.escu.analytic_story = ["Ransomware"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise.
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`
### END ESCU RESPONSE TASKS ###
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/workflow_actions.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-06-06T20:50:08 UTC
# On Date: 2022-06-22T17:37:56 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
Vendored
+2 -1
View File
@@ -1,6 +1,6 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 1
version: 2
description: The following analytic identifies native living off the land binaries
within the Windows operating system that may be abused by adversaries by moving
it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
@@ -49,6 +49,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
/(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path,
/(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false
AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
docs/_data/navigation.yml
+2
View File
@@ -60,6 +60,8 @@ detections:
url: /detections/network_traffic/
- title: Risk
url: /detections/risk/
- title: Splunk_Audit
url: /detections/splunk_audit/
- title: UEBA
url: /detections/ueba/
- title: Updates
docs/_pages/detections.md
+15
View File
@@ -571,6 +571,7 @@ sidebar:
| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Possible Browser Pass View Parameter](/endpoint/possible_browser_pass_view_parameter/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Potentially malicious code on commandline](/endpoint/potentially_malicious_code_on_commandline/) | [Windows Command Shell](/tags/#windows-command-shell) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -650,6 +651,7 @@ sidebar:
| [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Rundll32 LockWorkStation](/endpoint/rundll32_lockworkstation/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -692,10 +694,20 @@ sidebar:
| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Spectre and Meltdown Vulnerable Systems](/deprecated/spectre_and_meltdown_vulnerable_systems/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Spike in File Writes](/endpoint/spike_in_file_writes/) | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Command and Scripting Interpreter Risky SPL MLTK](/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Identified SSL TLS Certificates](/network/splunk_identified_ssl_tls_certificates/) | [Network Sniffing](/tags/#network-sniffing) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Process Injection Forwarder Bundle Downloads](/application/splunk_process_injection_forwarder_bundle_downloads/) | [Process Injection](/tags/#process-injection) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -841,6 +853,9 @@ sidebar:
| [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
docs/_pages/splunk_audit.md
+9
View File
@@ -0,0 +1,9 @@
---
title: Splunk_Audit
layout: tag
author_profile: false
taxonomy: Splunk_Audit
permalink: /detections/splunk_audit/
sidebar:
nav: "detections"
---
docs/_pages/stories.md
+4 -4
View File
@@ -39,7 +39,7 @@ sidebar:
| [Command and Control](command_and_control) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) |
| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution) |
| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [CyclopsBLink](cyclopsblink) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
| [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) |
@@ -68,7 +68,7 @@ sidebar:
| [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
| [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [BITS Jobs](/tags/#bits-jobs) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) |
| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access), [Exfiltration](/tags/#exfiltration) |
| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
| [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
| [Kubernetes Sensitive Object Access Activity](kubernetes_sensitive_object_access_activity) | None | None |
@@ -97,7 +97,7 @@ sidebar:
| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) |
| [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
| [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -109,7 +109,7 @@ sidebar:
| [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
| [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None |
| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Network Denial of Service](/tags/#network-denial-of-service), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
| [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
+1 -1
View File
@@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu
#### Macros
The SPL above uses the following Macros:
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
> :information_source:
> **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
+1 -1
View File
@@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed.
#### Macros
The SPL above uses the following Macros:
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
> :information_source:
> **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
+2 -2
View File
@@ -94,7 +94,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be
```
| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac
| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip All_Sessions.dest_mac
| dedup All_Sessions.dest_mac
| `drop_dm_object_name("Network_Sessions")`
|`drop_dm_object_name("All_Sessions")`
@@ -150,4 +150,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml) \| *version*: **1**
[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml) \| *version*: **2**
docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+1 -1
View File
@@ -100,9 +100,9 @@ This search looks for Web requests to faux domains similar to the one that you w
#### Macros
The SPL above uses the following Macros:
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
> :information_source:
> **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+1 -1
View File
@@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit
#### Macros
The SPL above uses the following Macros:
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
> :information_source:
> **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+1 -1
View File
@@ -110,9 +110,9 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
> :information_source:
> **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
+1 -1
View File
@@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia
#### Macros
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-04-25-suspicious_file_write.md
+1 -1
View File
@@ -99,9 +99,9 @@ The search looks for files created with names that have been linked to malicious
#### Macros
The SPL above uses the following Macros:
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
> :information_source:
> **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+1 -1
View File
@@ -103,8 +103,8 @@ This search looks for applications on the endpoint that you have marked as prohi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+1 -1
View File
@@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+1 -1
View File
@@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+1 -1
View File
@@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+1 -1
View File
@@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+1 -1
View File
@@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+1 -1
View File
@@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-03-16-detect_rare_executables.md
+1 -1
View File
@@ -113,9 +113,9 @@ This search will return a table of rare processes, the names of the systems runn
#### Macros
The SPL above uses the following Macros:
* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
> :information_source:
> **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+1 -1
View File
@@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and
#### Macros
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
> :information_source:
> **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+1 -1
View File
@@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K
#### Macros
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
> :information_source:
> **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+1 -1
View File
@@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
#### Macros
The SPL above uses the following Macros:
* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
> :information_source:
> **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-06-windows_event_log_cleared.md
+1 -1
View File
@@ -116,8 +116,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
#### Macros
The SPL above uses the following Macros:
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-08-detect_new_local_admin_account.md
+1 -1
View File
@@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad
#### Macros
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+1 -1
View File
@@ -118,9 +118,9 @@ This search looks for attempts to stop security-related services on the endpoint
#### Macros
The SPL above uses the following Macros:
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
> :information_source:
> **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+4 -4
View File
@@ -123,13 +123,13 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
#### Macros
The SPL above uses the following Macros:
* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
> :information_source:
docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+1 -1
View File
@@ -109,9 +109,9 @@ This search looks for web connections to dynamic DNS providers.
#### Macros
The SPL above uses the following Macros:
* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
> :information_source:
> **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+1 -1
View File
@@ -119,8 +119,8 @@ This search looks for EC2 instances being modified by users who have not previou
#### Macros
The SPL above uses the following Macros:
* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
+1 -1
View File
@@ -119,8 +119,8 @@ This search detects Okta login failures due to bad credentials for multiple user
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-okta_failed_sso_attempts.md
+1 -1
View File
@@ -117,8 +117,8 @@ Detect failed Okta SSO events
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
+1 -1
View File
@@ -118,8 +118,8 @@ This search detects logins from the same user from different cities in a 24 hour
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+1 -1
View File
@@ -117,9 +117,9 @@ This search looks for emails that have attachments with suspicious file extensio
#### Macros
The SPL above uses the following Macros:
* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
> :information_source:
> **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
+1 -1
View File
@@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+1 -1
View File
@@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom
#### Macros
The SPL above uses the following Macros:
* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
> :information_source:
> **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-08-11-detect_arp_poisoning.md
+1 -1
View File
@@ -128,8 +128,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+1 -1
View File
@@ -121,8 +121,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+1 -1
View File
@@ -113,9 +113,9 @@ This search looks for the creation or deletion of hidden shares using net.exe.
#### Macros
The SPL above uses the following Macros:
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
> :information_source:
> **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+1 -1
View File
@@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E
#### Macros
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
+1 -1
View File
@@ -130,8 +130,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-10-28-detect_port_security_violation.md
+1 -1
View File
@@ -129,8 +129,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-10-28-detect_traffic_mirroring.md
+1 -1
View File
@@ -124,8 +124,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-11-09-common_ransomware_notes.md
+1 -1
View File
@@ -108,9 +108,9 @@ The search looks for files created with names matching those typically used in r
#### Macros
The SPL above uses the following Macros:
* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
> :information_source:
> **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+1 -1
View File
@@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a
#### Macros
The SPL above uses the following Macros:
* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
> :information_source:
> **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+1 -1
View File
@@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
+1 -1
View File
@@ -113,8 +113,8 @@ This search detects the assignment of rights to accesss content from another mai
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-12-16-o365_pst_export_alert.md
+1 -1
View File
@@ -100,8 +100,8 @@ This search detects when a user has performed an Ediscovery search or exported a
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
+1 -1
View File
@@ -114,8 +114,8 @@ This search detects when an admin configured a forwarding rule for multiple mail
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
+1 -1
View File
@@ -114,8 +114,8 @@ This search detects when multiple user configured a forwarding rule to the same
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+1 -1
View File
@@ -112,8 +112,8 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+1 -1
View File
@@ -112,8 +112,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior
#### Macros
The SPL above uses the following Macros:
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
+1 -1
View File
@@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
+1 -1
View File
@@ -103,8 +103,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2021-01-26-o365_new_federated_domain_added.md
+1 -1
View File
@@ -105,8 +105,8 @@ This search detects the addition of a new Federated domain.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+1 -1
View File
@@ -113,8 +113,8 @@ Upon investigating, look for network connections to remote destinations (interna
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:

Some files were not shown because too many files have changed in this diff Show More