From 872fa44741fe9974303bf564f01a295599b91a35 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:04:12 -0700 Subject: [PATCH 001/114] initialdraft --- ...sonation_weak_encryption_configuration.yml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml new file mode 100644 index 0000000000..d4065a6a07 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -0,0 +1,51 @@ +name: Splunk protocol impersonation weak encryption configuration +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 1 +date: '2022-05-24' +author: Rod Soto, Splunk +type: TTP +datamodel: [] +search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' +description: On . +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. +known_false_positives: This search may find additional path traversal exploitation attempts. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-0000 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: Path traversal exploitation attempt from $clientip$ + mitre_attack_id: + - T1083 + observable: + - name: clientip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - status + - clientip + - method + - uri_path + - uri_query + risk_score: 40 + security_domain: threat From 352ac64d51b8cf8b1bf2b025666e6db007e38084 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:12:46 -0700 Subject: [PATCH 002/114] initialdrafta --- ...ol_impersonation_weak_encryption_configuration.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index d4065a6a07..c657d3c10d 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -3,14 +3,15 @@ id: 839d12a6-b119-4d44-ac4f-13eed95412c8 version: 1 date: '2022-05-24' author: Rod Soto, Splunk -type: TTP +type: Hunting datamodel: [] search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' -description: On . -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. -known_false_positives: This search may find additional path traversal exploitation attempts. +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +- https://www.splunk.com/en_us/product-security. +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: - Splunk Vulnerabilities From 9d1e62c7d05077dce1635b8f512798bbb464c3bf Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:55:47 -0700 Subject: [PATCH 003/114] initialdraftb --- ...sonation_weak_encryption_configuration.yml | 24 +++++++------------ 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index c657d3c10d..c593f9f514 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -8,7 +8,7 @@ datamodel: [] search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. -known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: - https://www.splunk.com/en_us/product-security. - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation @@ -18,35 +18,29 @@ tags: asset_type: Endpoint cve: - CVE-2022-0000 - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 80 context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt impact: 50 kill_chain_phases: - Exploitation - message: Path traversal exploitation attempt from $clientip$ + message: Failed to validate certificate on host$ mitre_attack_id: - T1083 observable: - - name: clientip - type: IP Address + - name: host + type: host role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - status - - clientip - - method - - uri_path - - uri_query + - host + - event_message + - component risk_score: 40 security_domain: threat From a802fecce8e0540e1239832bcb02f919a8d91cb3 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 14:01:02 -0700 Subject: [PATCH 004/114] initialdraftc --- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index c593f9f514..be511b8fe2 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -28,7 +28,7 @@ tags: - Exploitation message: Failed to validate certificate on host$ mitre_attack_id: - - T1083 + - T1588.004 observable: - name: host type: host From 99d314eeeae5398ec7bb068a1bf371cab80b4611 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:29:15 -0700 Subject: [PATCH 005/114] initialsearchskeleton --- ...l_impersonation_weak_encryption_configuration.yml | 8 ++++---- macros/splk_cert_validation_tls.yml | 4 ++++ ...ersonation_weak_encryption_configuration.test.yml | 12 ++++++++++++ 3 files changed, 20 insertions(+), 4 deletions(-) create mode 100644 macros/splk_cert_validation_tls.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index be511b8fe2..0f1bbb86ef 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -5,12 +5,12 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' +search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: -- https://www.splunk.com/en_us/product-security. +- https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: @@ -22,13 +22,13 @@ tags: context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt impact: 50 kill_chain_phases: - Exploitation message: Failed to validate certificate on host$ mitre_attack_id: - - T1588.004 + - T1588.004 observable: - name: host type: host diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml new file mode 100644 index 0000000000..7162e5e54f --- /dev/null +++ b/macros/splk_cert_validation_tls.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunkd diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml new file mode 100644 index 0000000000..de04dc05c5 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption configuration Unit Test +tests: +- name: Splunk protocol impersonation weak encryption configuration + file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 5680afbce7ee0b33086a9bb78b247660b92b463f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:35:46 -0700 Subject: [PATCH 006/114] fixtype --- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 0f1bbb86ef..77a9a1e58a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -31,7 +31,7 @@ tags: - T1588.004 observable: - name: host - type: host + type: hostname role: - Victim product: From 16641935e0bab34c72a6d0ac6dc6a20ede4fc994 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:37:39 -0700 Subject: [PATCH 007/114] fixanotherytpo --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 77a9a1e58a..1c7765c87c 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -30,8 +30,8 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: host - type: hostname + - name: hostname + type: hostname role: - Victim product: From 6ee71634218e027902a8a853293ed6da42c588eb Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:40:12 -0700 Subject: [PATCH 008/114] Hostname --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 1c7765c87c..e822c6a1ad 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -30,8 +30,8 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: hostname - type: hostname + - name: Hostname + type: Hostname role: - Victim product: From b51c08851337622a586344cd9aeb2734600f086c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 10:55:42 -0500 Subject: [PATCH 009/114] Fixing typo --- tests/application/splunk_user_enumeration_attempt.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_user_enumeration_attempt.test.yml b/tests/application/splunk_user_enumeration_attempt.test.yml index 40e966b1af..e2672a23c5 100644 --- a/tests/application/splunk_user_enumeration_attempt.test.yml +++ b/tests/application/splunk_user_enumeration_attempt.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: audittail.log + - file_name: audittrail.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log source: audittrail sourcetype: audittrail From ef545637557f8d0e387ba103952a9d2fdb35cfe0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 13:54:26 -0500 Subject: [PATCH 010/114] Adding detection --- ...sonation_weak_encryption_configuration.yml | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index e822c6a1ad..e3f2dfbc9a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -1,46 +1,47 @@ -name: Splunk protocol impersonation weak encryption configuration -id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +name: Splunk Protocol Impersonation Weak Encryption Configuration +id: 900892bf-70a9-4787-8c99-546dd98ce461 version: 1 -date: '2022-05-24' -author: Rod Soto, Splunk +date: '2022-05-25' +author: Lou Stella, Splunk type: Hunting datamodel: [] -search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. -known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: -- https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - cve: - - CVE-2022-0000 - confidence: 80 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log impact: 50 kill_chain_phases: - Exploitation - message: Failed to validate certificate on host$ + message: $splunk_server$ may not be properly validating TLS Certificates mitre_attack_id: - - T1588.004 + - T1001.003 + nist: + - DE.CM observable: - - name: Hostname - type: Hostname + - name: splunk_server + type: hostname role: - - Victim + - victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - host - - event_message - - component - risk_score: 40 + - none + risk_score: 50 security_domain: threat From 7bd84418068bfb3989af7bca4491af2c2400d959 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 13:55:43 -0500 Subject: [PATCH 011/114] Adding test, random data since irrelevant to detection --- ...rsonation_weak_encryption_configuration.test.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml index de04dc05c5..30ec9e3e5f 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -1,12 +1,13 @@ -name: Splunk protocol impersonation weak encryption configuration Unit Test +name: Splunk Protocol Impersonation Weak Encryption Configuration Unit Test tests: -- name: Splunk protocol impersonation weak encryption configuration +- name: Splunk Protocol Impersonation Weak Encryption Configuration file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt - source: "/opt/splunk/var/log/splunk/splunkd.log" - sourcetype: splunkd + - file_name: audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From b9d79c5ab18dbae939cedddac3b2e926cb9cdbbd Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 07:25:17 -0700 Subject: [PATCH 012/114] changednameofdetection --- ...sonation_weak_encryption_simplerequest.yml | 44 +++++++++++++++++++ macros/splk_cert_validation_tls.yml | 4 ++ ...ion_weak_encryption_simplerequest.test.yml | 12 +++++ 3 files changed, 60 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml create mode 100644 macros/splk_cert_validation_tls.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml new file mode 100644 index 0000000000..969e007c41 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -0,0 +1,44 @@ +name: Splunk protocol impersonation weak encryption simplerequest +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 1 +date: '2022-05-24' +author: Rod Soto, Splunk +type: Hunting +datamodel: [] +search: '|splk_cert_validation_tls "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +references: +- https://www.splunk.com/en_us/product-security +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: Failed to validate certificate on host$ + mitre_attack_id: + - T1588.004 + observable: + - name: Hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - host + - event_message + - path + risk_score: 40 + security_domain: threat diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml new file mode 100644 index 0000000000..f3a35ff78c --- /dev/null +++ b/macros/splk_cert_validation_tls.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunk_python source=/opt/splunk/var/log/splunk/python.log +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunk_protocol_impersonation_weak_encryption_simplerequest diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml new file mode 100644 index 0000000000..0243e65479 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption simplerequest Unit Test +tests: +- name: Splunk protocol impersonation weak encryption simplerequest + file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 89ee09b0f0bd0c3625d9c995593bac819f9cfebc Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 07:50:10 -0700 Subject: [PATCH 013/114] fixedmacros --- macros/splk_cert_validation_tls.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml index b9b35ceeca..88fb51ec38 100644 --- a/macros/splk_cert_validation_tls.yml +++ b/macros/splk_cert_validation_tls.yml @@ -1,8 +1,8 @@ <<<<<<< HEAD -definition: index=_internal sourcetype=splunk_python source=/opt/splunk/var/log/splunk/python.log +definition: index=_internal sourcetype=splunk_python description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_protocol_impersonation_weak_encryption_simplerequest +name: splunk_protocol_impersonation_weak_encryption_simplerequest ======= definition: index=_internal sourcetype=splunkd description: customer specific splunk configurations(eg- index, source, sourcetype). From 3f8d20e7b83e864b85301a7a83cb83121de5e109 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 07:54:23 -0700 Subject: [PATCH 014/114] macrofix --- macros/splk_cert_validation_tls.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml index 88fb51ec38..81d3154034 100644 --- a/macros/splk_cert_validation_tls.yml +++ b/macros/splk_cert_validation_tls.yml @@ -1,11 +1,4 @@ -<<<<<<< HEAD -definition: index=_internal sourcetype=splunk_python +definition: index=_internal sourcetype=splunk_python description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: splunk_protocol_impersonation_weak_encryption_simplerequest -======= -definition: index=_internal sourcetype=splunkd -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd ->>>>>>> 7bd84418068bfb3989af7bca4491af2c2400d959 From 39ee01a256434a1b0eedeb1d3c26335350e0f16a Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 08:04:57 -0700 Subject: [PATCH 015/114] datasetx --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- ...rotocol_impersonation_weak_encryption_simplerequest.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 969e007c41..f2722887dd 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -20,7 +20,7 @@ tags: context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt impact: 50 kill_chain_phases: - Exploitation diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml index 0243e65479..12a800bf11 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt source: "/opt/splunk/var/log/splunk/splunkd.log" sourcetype: splunkd From a766811c5661a13719218e0b108826eabd2affe7 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 10:32:09 -0500 Subject: [PATCH 016/114] 0602 hunt --- ...al_certificates_infrastructure_version.yml | 47 +++++++++++++++++++ ...rtificates_infrastructure_version.test.yml | 13 +++++ 2 files changed, 60 insertions(+) create mode 100644 detections/application/splunk_digital_certificates_infrastructure_version.yml create mode 100644 tests/application/splunk_digital_certificates_infrastructure_version.test.yml diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml new file mode 100644 index 0000000000..5a645b2f29 --- /dev/null +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -0,0 +1,47 @@ +name: Splunk Digital Certificates Infrastructure Version +id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Hunting +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $splunk_server$ may not be properly validating TLS Certificates + mitre_attack_id: + - T1587.003 + nist: + - DE.CM + observable: + - name: splunk_server + type: hostname + role: + - victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - none + risk_score: 50 + security_domain: threat diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml new file mode 100644 index 0000000000..0e4f63363b --- /dev/null +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -0,0 +1,13 @@ +name: Splunk Digital Certificates Infrastructure Version Unit Test +tests: +- name: Splunk Digital Certificates Infrastructure Version + file: application/splunk_digital_certificates_infrastructure_version.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From 44a1886061da1428b3a46cbb6e8b53d43e96e4c4 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 10:32:49 -0500 Subject: [PATCH 017/114] Missing field --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 5a645b2f29..5bea317b56 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -8,7 +8,7 @@ datamodel: [] description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication tags: From 92037c5992df5df7590a25a3ce2c4644b760ddd8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:39:00 -0500 Subject: [PATCH 018/114] deployment server --- ...s_injection_forwarder_bundle_downloads.yml | 52 +++++++++++++++++++ ...ection_forwarder_bundle_downloads.test.yml | 13 +++++ 2 files changed, 65 insertions(+) create mode 100644 detections/application/splunk_process_injection_forwarder_bundle_downloads.yml create mode 100644 tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml new file mode 100644 index 0000000000..17cf657ae4 --- /dev/null +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -0,0 +1,52 @@ +name: Splunk Process Injection Forwarder Bundle Downloads +id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Hunting +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. +known_false_positives: None at this time. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +tags: + analytic_story: + - Splunk Vulnerabilites + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 75 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $peer$ downloaded apps from $host$ + mitre_attack_id: + - T1055 + nist: + - DE.CM + observable: + - name: host + type: hostname + role: + - victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - component + - app + - serverclass + - peer + - host + risk_score: 37 + security_domain: threat diff --git a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml new file mode 100644 index 0000000000..ebe74285c3 --- /dev/null +++ b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml @@ -0,0 +1,13 @@ +name: Splunk Process Injection Forwarder Bundle Downloads Unit Test +tests: +- name: Splunk Process Injection Forwarder Bundle Downloads + file: application/splunk_process_injection_forwarder_bundle_downloads.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunkd.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd + update_timestamp: false From ef9c0ab6966f03bc2499cccfeacfb77d492c1709 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:40:47 -0500 Subject: [PATCH 019/114] Updated references --- .../splunk_digital_certificates_infrastructure_version.yml | 1 + ...lunk_protocol_impersonation_weak_encryption_configuration.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 5bea317b56..eed19e1c7e 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index e3f2dfbc9a..7ccd69f476 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html tags: analytic_story: - Splunk Vulnerabilities From 76f9fe7bbda8b63db349424899653577f5c40364 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:55:26 -0500 Subject: [PATCH 020/114] Updated validation issues --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- .../splunk_process_injection_forwarder_bundle_downloads.yml | 6 +++--- ...protocol_impersonation_weak_encryption_configuration.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index eed19e1c7e..34af5dc48d 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: splunk_server - type: hostname + type: Hostname role: - victim product: diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 17cf657ae4..adba811768 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -20,7 +20,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 75 + confidence: 70 context: - Source:Endpoint dataset: @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: host - type: hostname + type: Hostname role: - victim product: @@ -48,5 +48,5 @@ tags: - serverclass - peer - host - risk_score: 37 + risk_score: 35 security_domain: threat diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 7ccd69f476..ded2d69f49 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: splunk_server - type: hostname + type: Hostname role: - victim product: From 522e569cedae2e3cf718df73829f9ff3c5d05855 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 09:58:07 -0700 Subject: [PATCH 021/114] splkselfsigneddetection --- ...personation_weak_encryption_selfsigned.yml | 41 +++++++++++++++++++ .../splk_cert_validation_tls_selfsigned.yml | 4 ++ ...nation_weak_encryption_selfsigned.test.yml | 12 ++++++ 3 files changed, 57 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml create mode 100644 macros/splk_cert_validation_tls_selfsigned.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml new file mode 100644 index 0000000000..cf64ca56c2 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -0,0 +1,41 @@ +name: Splunk protocol impersonation weak encryption selfsigned +id: c76c7a2e-df49-414a-bb36-dce2683770de +version: 1 +date: '2022-05-26' +author: Rod Soto, Splunk +type: Hunting +datamodel: [] +search: '|index=_internal sourcetype="splunkd" certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. +known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +references: +- https://www.splunk.com/en_us/product-security +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt + message: Splunk default issued certificate at host$ + mitre_attack_id: + - T1588.004 + observable: + - name: Hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - host + - CN + - event_message + risk_score: 40 + security_domain: threat diff --git a/macros/splk_cert_validation_tls_selfsigned.yml b/macros/splk_cert_validation_tls_selfsigned.yml new file mode 100644 index 0000000000..2a9c676d9d --- /dev/null +++ b/macros/splk_cert_validation_tls_selfsigned.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunk_protocol_impersonation_weak_encryption_selfsigned diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml new file mode 100644 index 0000000000..12a800bf11 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption simplerequest Unit Test +tests: +- name: Splunk protocol impersonation weak encryption simplerequest + file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 234be83ef15851f23e7f1cb8ea1017e99677e9b4 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:05:14 -0500 Subject: [PATCH 022/114] Updated observable --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- .../splunk_process_injection_forwarder_bundle_downloads.yml | 2 +- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 34af5dc48d..a053b6a5fe 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -37,7 +37,7 @@ tags: - name: splunk_server type: Hostname role: - - victim + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index adba811768..c777653269 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -37,7 +37,7 @@ tags: - name: host type: Hostname role: - - victim + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index ded2d69f49..ad0c8be65c 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -37,7 +37,7 @@ tags: - name: splunk_server type: Hostname role: - - victim + - Victim product: - Splunk Enterprise - Splunk Enterprise Security From d0e6ef17ced454030c2c58672262049b98d938e9 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 10:08:38 -0700 Subject: [PATCH 023/114] fixedmacros --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index cf64ca56c2..96ef38797f 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '|index=_internal sourcetype="splunkd" certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '| `splk_cert_validation_tls_selfsigned` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index f2722887dd..3e950747b4 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '|splk_cert_validation_tls "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '| `splk_cert_validation_tls` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. From 2a9d78d7fda3423dac4f0376ec1a203125744f8f Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 10:16:31 -0700 Subject: [PATCH 024/114] fixedimpact --- .../splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 96ef38797f..b4a0cdae42 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -21,6 +21,7 @@ tags: - Source:Endpoint dataset: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt + impact: 50 message: Splunk default issued certificate at host$ mitre_attack_id: - T1588.004 From d43d0ce270ebc49f49f03b4c26ff3f3bdb706f6a Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 10:18:53 -0700 Subject: [PATCH 025/114] killchain --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index b4a0cdae42..4987ba912a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -22,6 +22,8 @@ tags: dataset: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt impact: 50 + kill_chain_phases: + - Exploitation message: Splunk default issued certificate at host$ mitre_attack_id: - T1588.004 From 7d2a728085976bb5d0eb7635b3ddff63cf5a2094 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:21:20 -0500 Subject: [PATCH 026/114] anomaly for non TLS forwarders --- ...igital_certificates_lack_of_encryption.yml | 53 +++++++++++++++++++ ...l_certificates_lack_of_encryption.test.yml | 13 +++++ 2 files changed, 66 insertions(+) create mode 100644 detections/application/splunk_digital_certificates_lack_of_encryption.yml create mode 100644 tests/application/splunk_digital_certificates_lack_of_encryption.test.yml diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml new file mode 100644 index 0000000000..56daf54a7a --- /dev/null +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -0,0 +1,53 @@ +name: Splunk Digital Certificates Lack of Encryption +id: 386a7ebc-737b-48cf-9ca8-5405459ed508 +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Anomaly +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +search: '| `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' +how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. +known_false_positives: None at this time +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log + impact: 25 + kill_chain_phases: + - Exploitation + message: $hostname$ is not using TLS when forwarding data + mitre_attack_id: + - T1587.003 + nist: + - DE.CM + observable: + - name: hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - group + - ssl + - sourceIp + - fwdType + - version + - hostname + risk_score: 20 + security_domain: threat diff --git a/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml new file mode 100644 index 0000000000..6fc83c2e2f --- /dev/null +++ b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml @@ -0,0 +1,13 @@ +name: Splunk Digital Certificates Lack of Encryption Unit Test +tests: +- name: Splunk Digital Certificates Lack of Encryption + file: application/splunk_digital_certificates_lack_of_encryption.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunkd.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log + source: "/opt/splunk/var/log/splunk/metrics.log" + sourcetype: splunkd + update_timestamp: false From 21d5a68dd9f5bc29d2e102954f8bfa70c70929f2 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 26 May 2022 11:28:08 -0600 Subject: [PATCH 027/114] Splunk Command and Scripting Interpreter Risky Commands --- ...d_scripting_interpreter_risky_commands.yml | 63 +++++++++++++++++++ ...rtificates_infrastructure_version.test.yml | 1 + 2 files changed, 64 insertions(+) create mode 100644 detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml new file mode 100644 index 0000000000..281f6ffbe0 --- /dev/null +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -0,0 +1,63 @@ +name: Splunk Command and Scripting Interpreter Risky Commands +id: 1cf58ae1-9177-40b8-a26c-8966040f11ae +version: 1 +date: '2022-05-23' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - + Copying or transferring data (data exfiltration), Deleting data and Overwriting data. + A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. + During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*runshellscript*", "*collect*","*delete*", "*fit*", "*outputcsv*", "*outputlookup*", "*run*", "*script*", "*sendalert*", "*sendemail*", "*tscollect*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user + by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type + | `drop_dm_object_name(Splunk_Audit)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_command_and_scripting_interpreter_risky_commands_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. +known_false_positives: False positives will be present until properly filtered by Username, search name, and so forth. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: A risky Splunk command has ran by $user$ and should be reviewed. + mitre_attack_id: + - T1213 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.info + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.savedsearch_name + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml index 0e4f63363b..a65603b137 100644 --- a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -11,3 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + From fb25e4def0969ca9077ccda0c317371e59b90e08 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 26 May 2022 11:38:35 -0600 Subject: [PATCH 028/114] Splunk Command and Scripting Interpreter Risky Commands --- ...nd_scripting_interpreter_risky_commands.test.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml diff --git a/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml new file mode 100644 index 0000000000..81490c8a0e --- /dev/null +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml @@ -0,0 +1,13 @@ +name: Splunk Command and Scripting Interpreter Risky Commands Unit Test +tests: +- name: Splunk Command and Scripting Interpreter Risky Commands + file: application/splunk_command_and_scripting_interpreter_risky_commands.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audittrail.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From d807ca429a1bfc19ce7a317e91266a52b3370376 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:46:34 -0500 Subject: [PATCH 029/114] Updating MITRE ATT&CK --- detections/endpoint/linux_at_application_execution.yml | 2 +- .../linux_possible_append_command_to_at_allow_config_file.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 34d7f80af6..5e00bb941a 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -48,7 +48,7 @@ tags: - Exploitation message: At application was executed in $dest$ mitre_attack_id: - - T1053.001 + - T1053.002 - T1053 nist: - DE.CM diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index a23a4f5174..03fba912bf 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -49,7 +49,7 @@ tags: - Exploitation message: A commandline $process$ that may modify at allow config file in $dest$ mitre_attack_id: - - T1053.001 + - T1053.002 - T1053 nist: - DE.CM From e6dcc82562c08ea6b2e484a09bd3071fa06b8cec Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:52:42 -0500 Subject: [PATCH 030/114] Updating tactic --- detections/endpoint/macos_plutil.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml index 3401678938..a847e5eb7d 100644 --- a/detections/endpoint/macos_plutil.yml +++ b/detections/endpoint/macos_plutil.yml @@ -39,7 +39,7 @@ tags: - Actions on Objectives message: plutil are executed on $host$ from $user$ mitre_attack_id: - - T1547.011 + - T1647 nist: - DE.CM observable: From 6ddebf3a2d21dc0c71faf18f553ad12c6cbf447e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 26 May 2022 12:28:21 -0600 Subject: [PATCH 031/114] ssl tls ver --- ...splunk_identified_ssl_tls_certificates.yml | 54 +++++++++++++++++++ ...k_identified_ssl_tls_certificates.test.yml | 13 +++++ 2 files changed, 67 insertions(+) create mode 100644 detections/network/splunk_identified_ssl_tls_certificates.yml create mode 100644 tests/network/splunk_identified_ssl_tls_certificates.test.yml diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml new file mode 100644 index 0000000000..71a7988185 --- /dev/null +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -0,0 +1,54 @@ +name: Splunk Identified SSL TLS Certificates +id: 620fbb89-86fd-4e2e-925f-738374277586 +version: 1 +date: '2022-05-25' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Network_Traffic +description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype + | `splunk_identified_ssl_tls_certificates_filter`' +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. +known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. +references: + - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Proxy + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Application Log + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log + impact: 100 + kill_chain_phases: + - Reconnaissance + message: The following $dest$ is using the self signed Splunk certificate. + mitre_attack_id: + - T1040 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - ssl_issuer + - ssl_subject_common_name + - ssl_subject_organization + - ssl_subject + - host + - sourcetype + risk_score: 100 + security_domain: network \ No newline at end of file diff --git a/tests/network/splunk_identified_ssl_tls_certificates.test.yml b/tests/network/splunk_identified_ssl_tls_certificates.test.yml new file mode 100644 index 0000000000..fb43c99049 --- /dev/null +++ b/tests/network/splunk_identified_ssl_tls_certificates.test.yml @@ -0,0 +1,13 @@ +name: Splunk Identified SSL TLS Certificates Unit Test +tests: +- name: Splunk Identified SSL TLS Certificates + file: network/splunk_identified_ssl_tls_certificates.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: ssl_splunk.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log + source: stream:tcp + sourcetype: stream:tcp + update_timestamp: true From 177a9736d3813b5f6d46fe4520c3b3fa677bcf2c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 27 May 2022 14:25:20 -0600 Subject: [PATCH 032/114] Update splunk_command_and_scripting_interpreter_risky_commands.yml fixed --- ...unk_command_and_scripting_interpreter_risky_commands.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 281f6ffbe0..ee44e7f604 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -10,10 +10,10 @@ description: 'The Splunk platform contains built-in search processing language ( Copying or transferring data (data exfiltration), Deleting data and Overwriting data. A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*runshellscript*", "*collect*","*delete*", "*fit*", "*outputcsv*", "*outputlookup*", "*run*", "*script*", "*sendalert*", "*sendemail*", "*tscollect*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user - by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user + by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Splunk_Audit)` - | `security_content_ctime(firstTime)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. From 926e63649ab557a453d282e61180b260cfd95f1f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 27 May 2022 14:41:34 -0600 Subject: [PATCH 033/114] delete usage --- ...and_scripting_interpreter_delete_usage.yml | 60 +++++++++++++++++++ ...cripting_interpreter_delete_usage.test.yml | 14 +++++ 2 files changed, 74 insertions(+) create mode 100644 detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml create mode 100644 tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml new file mode 100644 index 0000000000..2bfdd6f358 --- /dev/null +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -0,0 +1,60 @@ +name: Splunk Command and Scripting Interpreter Delete Usage +id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 +version: 1 +date: '2022-05-27' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user + by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type + | `drop_dm_object_name(Splunk_Audit)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_command_and_scripting_interpreter_delete_usage_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. +known_false_positives: False positives may be present if this command is used as a common practive. Filter as needed. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Delete command has ran by $user$ and should be reviewed. + mitre_attack_id: + - T1213 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.info + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.savedsearch_name + - Search_Activity.search_type + risk_score: 100 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml new file mode 100644 index 0000000000..a44479a465 --- /dev/null +++ b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml @@ -0,0 +1,14 @@ +name: Splunk Command and Scripting Interpreter Delete Usage Unit Test +tests: +- name: Splunk Command and Scripting Interpreter Delete Usage + file: application/splunk_command_and_scripting_interpreter_delete_usage.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audittrail.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true + update_timestamp: true From ce599810c6f65f68bd1326b8496c1e7b19d3ba62 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 27 May 2022 15:00:35 -0600 Subject: [PATCH 034/114] confidence --- ...splunk_command_and_scripting_interpreter_risky_commands.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index ee44e7f604..84d03de18b 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -9,7 +9,8 @@ datamodel: description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. - During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity.' + During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity. + In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Splunk_Audit)` From 529faf008b651b562d078d749b579a08169d7549 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 May 2022 14:35:43 -0700 Subject: [PATCH 035/114] adding files from PR 2194 --- .../potential_password_in_username.yml | 95 +++++++++++++++++++ .../potential_password_in_username.test.yml | 12 +++ 2 files changed, 107 insertions(+) create mode 100644 detections/endpoint/potential_password_in_username.yml create mode 100644 tests/endpoint/potential_password_in_username.test.yml diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml new file mode 100644 index 0000000000..fa50c36988 --- /dev/null +++ b/detections/endpoint/potential_password_in_username.yml @@ -0,0 +1,95 @@ +name: Potential password in username +id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 +version: 1 +date: '2022-05-11' +author: Mikael Bjerkeland, Splunk +type: Anomaly +datamodel: +- Authentication +description: This search identifies users who have entered their passwords in username + fields. This is done by looking for failed authentication attempts using usernames with a length + longer than 7 characters and a high Shannon entropy, and looks for the next successful + authentication attempt from the same source system to the same destination system + as the failed attempt. +search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime + latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src + values(Authentication.dest) AS dest count FROM datamodel=Authentication + WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" + | `drop_dm_object_name(Authentication)` + | lookup ut_shannon_lookup word AS user + | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 + | sort count, - ut_shannon + | eval incorrect_password=user + | eval endtime=endtime+1000 + | map maxsearches=70 search="| tstats `security_content_summariesonly` + earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype + values(Authentication.src) AS src values(Authentication.dest) AS dest count + FROM datamodel=Authentication WHERE nodename=Authentication.Successful_Authentication + Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") + earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" + | `drop_dm_object_name(\"Authentication\")` + | `potential_password_in_username_false_positive_reduction` + | eval incorrect_password=\"$incorrect_password$\" + | eval ut_shannon=\"$ut_shannon$\" + | sort count" + | where user!=incorrect_password + | outlier action=RM count + | `potential_password_in_username_filter`' +how_to_implement: To successfully implement this search, you need to have relevant + authentication logs mapped to the Authentication data model. You also need to + have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. + The detection must run with a time interval shorter than endtime+1000. +known_false_positives: Valid usernames with high entropy or source/destination system pairs + with multiple authenticating users will make it difficult to identify the real user + authenticating. +references: +- https://medium.com/@markmotig/search-for-passwords-accidentally-typed-into-the-username-field-975f1a389928 +tags: + analytic_story: + - Credential Dumping + - Insider Threat + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Source:AD + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/password_in_username/linux_secure.log + impact: 30 + kill_chain_phases: + - Reconnaissance + message: Potential password in username ($user$) with Shannon entropy ($ut_shannon$) + mitre_attack_id: + - T1078.003 + - T1552.001 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Authentication.user + - Authentication.src + - Authentication.dest + - sourcetype + risk_score: 21 + security_domain: access \ No newline at end of file diff --git a/tests/endpoint/potential_password_in_username.test.yml b/tests/endpoint/potential_password_in_username.test.yml new file mode 100644 index 0000000000..549a08c3af --- /dev/null +++ b/tests/endpoint/potential_password_in_username.test.yml @@ -0,0 +1,12 @@ +name: Potential password in username Unit Test +tests: +- name: Potential password in username + file: endpoint/potential_password_in_username.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: linux_secure.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/password_in_username/linux_secure.log + source: /var/log/secure + sourcetype: linux_secure \ No newline at end of file From 96a391dbc9dfbdb2032e7f1b236b3dce50a94a0b Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 31 May 2022 10:38:13 -0500 Subject: [PATCH 036/114] Updating DM --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- .../splunk_command_and_scripting_interpreter_risky_commands.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 2bfdd6f358..c04a9f5562 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -5,7 +5,7 @@ date: '2022-05-27' author: Michael Haag, Splunk type: Anomaly datamodel: -- Endpoint +- Splunk_Audit description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 84d03de18b..f940895bc3 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -5,7 +5,7 @@ date: '2022-05-23' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Splunk_Audit description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. From c7ad4a013b67f09fd2120a851a9fcdcc128d1eba Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 31 May 2022 10:58:08 -0500 Subject: [PATCH 037/114] Updating DM enum --- .../contentctl_core/domain/entities/enums/enums.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py index 848e8f176d..6b68f5049b 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py @@ -24,6 +24,7 @@ class DataModel(enum.Enum): Endpoint_Filesystem = 14 Endpoint_Registry = 15 Risk = 16 + Splunk_Audit = 17 class SecurityContentType(enum.Enum): detections = 1 From 97d51b71bf056a4ee1777f69bf1b8cf40769b0e0 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 1 Jun 2022 17:03:00 -0400 Subject: [PATCH 038/114] adding cves --- ...splunk_command_and_scripting_interpreter_delete_usage.yml | 4 +++- ...lunk_command_and_scripting_interpreter_risky_commands.yml | 4 +++- .../splunk_digital_certificates_infrastructure_version.yml | 4 +++- .../splunk_digital_certificates_lack_of_encryption.yml | 2 ++ .../splunk_process_injection_forwarder_bundle_downloads.yml | 5 ++++- ..._protocol_impersonation_weak_encryption_configuration.yml | 4 +++- ...unk_protocol_impersonation_weak_encryption_selfsigned.yml | 4 +++- ..._protocol_impersonation_weak_encryption_simplerequest.yml | 4 +++- .../network/splunk_identified_ssl_tls_certificates.yml | 5 ++++- 9 files changed, 28 insertions(+), 8 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index c04a9f5562..6fdeed8d30 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -25,6 +25,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32154 confidence: 100 context: - Source:Endpoint @@ -57,4 +59,4 @@ tags: - Search_Activity.search_type risk_score: 100 security_domain: audit - \ No newline at end of file + diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index f940895bc3..34d2176d03 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -29,6 +29,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + CVE-2022-32154 confidence: 40 context: - Source:Endpoint @@ -61,4 +63,4 @@ tags: - Search_Activity.search_type risk_score: 20 security_domain: audit - \ No newline at end of file + diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index a053b6a5fe..620e753281 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. known_false_positives: No known at this time. @@ -20,6 +20,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32153 confidence: 100 context: - Source:Endpoint diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 56daf54a7a..8b2f4ab058 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -20,6 +20,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32151 confidence: 80 context: - Source:Endpoint diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index c777653269..e2de4532d5 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. known_false_positives: None at this time. @@ -20,6 +20,9 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32157 + - CVE-2022-32158 confidence: 70 context: - Source:Endpoint diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index ad0c8be65c..1eeca76ac5 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -5,7 +5,7 @@ date: '2022-05-25' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. @@ -20,6 +20,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32151 confidence: 100 context: - Source:Endpoint diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 4987ba912a..66f769a0e1 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '| `splk_cert_validation_tls_selfsigned` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. references: @@ -16,6 +16,8 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint + cve: + - CVE-2022-32152 confidence: 80 context: - Source:Endpoint diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 3e950747b4..5c653533c7 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '| `splk_cert_validation_tls` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. +description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: @@ -16,6 +16,8 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint + cve: + - CVE-2022-32152 confidence: 80 context: - Source:Endpoint diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index 71a7988185..d20ed006b3 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -21,6 +21,9 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32151 + - CVE-2022-32152 confidence: 100 context: - Source:Application Log @@ -51,4 +54,4 @@ tags: - host - sourcetype risk_score: 100 - security_domain: network \ No newline at end of file + security_domain: network From d5a1d0010e04ff5bf1abed97cd58698409a3a0f3 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:19:38 -0700 Subject: [PATCH 039/114] added cis tags --- ...k_protocol_impersonation_weak_encryption_simplerequest.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 5c653533c7..a0d7b45a46 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -18,6 +18,10 @@ tags: asset_type: Endpoint cve: - CVE-2022-32152 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 confidence: 80 context: - Source:Endpoint From ae4dc0039298c1fe479101de536e05881c92e9a2 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:21:54 -0700 Subject: [PATCH 040/114] tags added --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index a0d7b45a46..cb24899fd6 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -33,6 +33,8 @@ tags: message: Failed to validate certificate on host$ mitre_attack_id: - T1588.004 + nist: + - DE.CM observable: - name: Hostname type: Hostname From 9b6cd6a022b667c1f97f5dbd60c5fdc88820423d Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:31:53 -0700 Subject: [PATCH 041/114] added tags --- ...nk_protocol_impersonation_weak_encryption_selfsigned.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 66f769a0e1..ef8644690a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -16,6 +16,10 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 cve: - CVE-2022-32152 confidence: 80 @@ -29,6 +33,8 @@ tags: message: Splunk default issued certificate at host$ mitre_attack_id: - T1588.004 + nist: + - DE.CM observable: - name: Hostname type: Hostname From 61e827c41e8975c18530e26f8ea31ae42fb068cb Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:38:28 -0700 Subject: [PATCH 042/114] added - to CVE --- ...plunk_command_and_scripting_interpreter_risky_commands.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 34d2176d03..9d68135295 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -29,9 +29,9 @@ tags: - CIS 3 - CIS 5 - CIS 16 - cve: - CVE-2022-32154 confidence: 40 + cve: + - CVE-2022-32154 context: - Source:Endpoint dataset: From 066ac9ffb3496faf39587f54d7644fbbd5f438fb Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Jun 2022 11:50:27 +0200 Subject: [PATCH 043/114] more-defense-evasion --- ...nses_disable_win_defender_auto_logging.yml | 74 +++++++++++++++++++ ...disable_win_defender_auto_logging.test.yml | 13 ++++ 2 files changed, 87 insertions(+) create mode 100644 detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml create mode 100644 tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml new file mode 100644 index 0000000000..0916e2333b --- /dev/null +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -0,0 +1,74 @@ +name: Windows Impair Defenses Disable Win Defender Auto Logging +id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c +version: 1 +date: '2022-06-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. + This is consistent with RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an malware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log + impact: 30 + kill_chain_phases: + - Delivery + message: Windows Defender Logger registry key set to 'disabled' on $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + nist: + - PR.PT + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + risk_score: 24 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml b/tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml new file mode 100644 index 0000000000..cde741f1e6 --- /dev/null +++ b/tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml @@ -0,0 +1,13 @@ +name: Windows Impair Defenses Disable Win Defender Auto Logging Unit Test +tests: +- name: Windows Impair Defenses Disable Win Defender Auto Logging + file: endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 7c2dd368cdc3011b0f2c100574f51d4cf2cc0ec5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Jun 2022 12:53:31 +0200 Subject: [PATCH 044/114] more-defense-evasion --- ...fense_delete_win_defender_context_menu.yml | 74 +++++++++++++++++++ ..._delete_win_defender_context_menu.test.yml | 13 ++++ 2 files changed, 87 insertions(+) create mode 100644 detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml create mode 100644 tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml new file mode 100644 index 0000000000..9a15e14a7b --- /dev/null +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -0,0 +1,74 @@ +name: Windows Impair Defense Delete Win Defender Context Menu +id: 395ed5fe-ad13-4366-9405-a228427bdd91 +version: 1 +date: '2022-06-07' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The search looks for the deletion of windows defender context menu registry. + This is consistent with RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an malware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_delete_win_defender_context_menu_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + impact: 50 + kill_chain_phases: + - Delivery + message: Windows Defender context menu registry key deleted on $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + nist: + - PR.PT + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + risk_score: 25 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml b/tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml new file mode 100644 index 0000000000..d565f72755 --- /dev/null +++ b/tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml @@ -0,0 +1,13 @@ +name: Windows Impair Defense Delete Win Defender Context Menu Unit Test +tests: +- name: Windows Impair Defense Delete Win Defender Context Menu + file: endpoint/windows_impair_defense_delete_win_defender_context_menu.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From bc57962c0c441bd3398f9200459b27f3186696c1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Jun 2022 13:13:02 +0200 Subject: [PATCH 045/114] more-defense-evasion --- ...fense_delete_win_defender_context_menu.yml | 1 + ...e_delete_win_defender_profile_registry.yml | 75 +++++++++++++++++++ ...nses_disable_win_defender_auto_logging.yml | 1 + ...ete_win_defender_profile_registry.test.yml | 13 ++++ 4 files changed, 90 insertions(+) create mode 100644 detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml create mode 100644 tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 9a15e14a7b..53f8d45a9e 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -68,6 +68,7 @@ tags: - Registry.dest - Registry.user - Registry.registry_path + - Registry.action risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml new file mode 100644 index 0000000000..9053e9090b --- /dev/null +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -0,0 +1,75 @@ +name: Windows Impair Defense Delete Win Defender Profile Registry +id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96 +version: 1 +date: '2022-06-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The search looks for the deletion of windows defender main profile registry. + This was used by RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an malware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_delete_win_defender_profile_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + impact: 80 + kill_chain_phases: + - Delivery + message: Windows Defender Logger registry key set to 'disabled' on $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + nist: + - PR.PT + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + risk_score: 64 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 0916e2333b..9fc4c91fc9 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -68,6 +68,7 @@ tags: - Registry.dest - Registry.user - Registry.registry_path + - Registry.action risk_score: 24 security_domain: endpoint supported_tas: diff --git a/tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml b/tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml new file mode 100644 index 0000000000..98d360eb71 --- /dev/null +++ b/tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml @@ -0,0 +1,13 @@ +name: Windows Impair Defense Delete Win Defender Profile Registry Unit Test +tests: +- name: Windows Impair Defense Delete Win Defender Profile Registry + file: endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From d8c3d523b5372da9a7fb57bc2503965d94d8044d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Jun 2022 07:10:27 -0600 Subject: [PATCH 046/114] touchup --- ...pair_defense_delete_win_defender_context_menu.yml | 12 ++++++------ ..._defense_delete_win_defender_profile_registry.yml | 8 ++++---- ...ir_defenses_disable_win_defender_auto_logging.yml | 6 +++--- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 53f8d45a9e..79175bf985 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: The search looks for the deletion of windows defender context menu registry. - This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an malware actor gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple +description: The search looks for the deletion of Windows Defender context menu within the registry. + This is consistent behavior with RAT malware across a fleet of endpoints. This particular + behavior is executed when an adversary gains access to an endpoint + and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. + processes and identify any further file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user @@ -45,7 +45,7 @@ tags: impact: 50 kill_chain_phases: - Delivery - message: Windows Defender context menu registry key deleted on $dest$ + message: Windows Defender context menu registry key deleted on $dest$. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index 9053e9090b..c8f7a347bd 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The search looks for the deletion of windows defender main profile registry. +description: The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an malware actor gains access to an endpoint + behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. + processes and identify any further file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest @@ -45,7 +45,7 @@ tags: impact: 80 kill_chain_phases: - Delivery - message: Windows Defender Logger registry key set to 'disabled' on $dest$ + message: Windows Defender Logger registry key set to 'disabled' on $dest$. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 9fc4c91fc9..3701411852 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -8,10 +8,10 @@ datamodel: - Endpoint description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an malware actor gains access to an endpoint + behavior is typically executed when anadversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. + processes and identify any further file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user @@ -45,7 +45,7 @@ tags: impact: 30 kill_chain_phases: - Delivery - message: Windows Defender Logger registry key set to 'disabled' on $dest$ + message: Windows Defender Logger registry key set to 'disabled' on $dest$. mitre_attack_id: - T1562.001 - T1562 From 3fb342d4c40951db605409c507e2899dcd6ca114 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 10:31:53 -0700 Subject: [PATCH 047/114] Fixed improperly named macro. Renamed the macro in the tests that use that macro. Added the optional field, "custom_index" to the test files which MUST upload data into the _audit index. This branch doesn't support custom_index yet, but those changes will be merged soon from another branch. --- ...lunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...k_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- macros/splk_cert_validation_tls_selfsigned.yml | 4 ---- macros/{splk_cert_validation_tls.yml => splunk_python.yml} | 2 +- ...nk_command_and_scripting_interpreter_delete_usage.test.yml | 1 + ..._command_and_scripting_interpreter_risky_commands.test.yml | 1 + ...plunk_digital_certificates_infrastructure_version.test.yml | 1 + ...tocol_impersonation_weak_encryption_configuration.test.yml | 1 + tests/application/splunk_user_enumeration_attempt.test.yml | 1 + 9 files changed, 8 insertions(+), 7 deletions(-) delete mode 100644 macros/splk_cert_validation_tls_selfsigned.yml rename macros/{splk_cert_validation_tls.yml => splunk_python.yml} (76%) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index ef8644690a..bb4d914929 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splk_cert_validation_tls_selfsigned` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '| `splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index cb24899fd6..f4d39041c9 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splk_cert_validation_tls` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '| `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. diff --git a/macros/splk_cert_validation_tls_selfsigned.yml b/macros/splk_cert_validation_tls_selfsigned.yml deleted file mode 100644 index 2a9c676d9d..0000000000 --- a/macros/splk_cert_validation_tls_selfsigned.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunkd -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_protocol_impersonation_weak_encryption_selfsigned diff --git a/macros/splk_cert_validation_tls.yml b/macros/splunk_python.yml similarity index 76% rename from macros/splk_cert_validation_tls.yml rename to macros/splunk_python.yml index 81d3154034..308c5cb662 100644 --- a/macros/splk_cert_validation_tls.yml +++ b/macros/splunk_python.yml @@ -1,4 +1,4 @@ definition: index=_internal sourcetype=splunk_python description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_protocol_impersonation_weak_encryption_simplerequest +name: splunk_python diff --git a/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml index a44479a465..76dad686b1 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml @@ -12,3 +12,4 @@ tests: sourcetype: audittrail update_timestamp: true update_timestamp: true + custom_index: _audit diff --git a/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml index 81490c8a0e..c29ea0ff8f 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml @@ -11,3 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + custom_index: _audit \ No newline at end of file diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml index a65603b137..c924075332 100644 --- a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -11,4 +11,5 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + custom_index: _audit diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml index 30ec9e3e5f..fe62b80f8f 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -11,3 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + custom_index: _audit diff --git a/tests/application/splunk_user_enumeration_attempt.test.yml b/tests/application/splunk_user_enumeration_attempt.test.yml index e2672a23c5..767973f5c4 100644 --- a/tests/application/splunk_user_enumeration_attempt.test.yml +++ b/tests/application/splunk_user_enumeration_attempt.test.yml @@ -10,3 +10,4 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log source: audittrail sourcetype: audittrail + custom_index: _audit From e8abbd916b5c54aed15bf89d02521cf4abce87e0 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 11:08:21 -0700 Subject: [PATCH 048/114] Added missing _internal custom_indexes to relevant test files. Removed the | character from searches that use index and sourcetype macros at the beginning of the search. --- .../splunk_digital_certificates_lack_of_encryption.yml | 2 +- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- .../splunk_digital_certificates_lack_of_encryption.test.yml | 1 + ...splunk_process_injection_forwarder_bundle_downloads.test.yml | 1 + 5 files changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 8b2f4ab058..b156555281 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -6,7 +6,7 @@ author: Lou Stella, Splunk type: Anomaly datamodel: [] description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. -search: '| `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' +search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. known_false_positives: None at this time references: diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index bb4d914929..adc754f31b 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index f4d39041c9..84cf983f75 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. diff --git a/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml index 6fc83c2e2f..c10d9691bf 100644 --- a/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml +++ b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml @@ -11,3 +11,4 @@ tests: source: "/opt/splunk/var/log/splunk/metrics.log" sourcetype: splunkd update_timestamp: false + custom_index: _internal diff --git a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml index ebe74285c3..56f48d2ca3 100644 --- a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml +++ b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml @@ -11,3 +11,4 @@ tests: source: "/opt/splunk/var/log/splunk/splunkd.log" sourcetype: splunkd update_timestamp: false + custom_index: _internal From 47cd84d377aa1acf7d8a19a9e87d8061cef28b28 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 11:46:42 -0700 Subject: [PATCH 049/114] Wrong sourcetype declared in one of the test files, causing it to fail. Fixed missing backticks on some macros. --- ...plunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...nk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- ...otocol_impersonation_weak_encryption_simplerequest.test.yml | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index adc754f31b..ed8fa37722 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 84cf983f75..07c3137ce6 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml index 12a800bf11..061bab1df9 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml @@ -9,4 +9,5 @@ tests: - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt source: "/opt/splunk/var/log/splunk/splunkd.log" - sourcetype: splunkd + sourcetype: splunk_python + custom_index: _internal From 10b2b29122c065298f98c6adf83c02d4152b954d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 12:14:46 -0700 Subject: [PATCH 050/114] Adding appropriate custom_index to detection and fixing naming error and file_name error --- ...col_impersonation_weak_encryption_selfsigned.test.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml index 12a800bf11..d97cf683a0 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -1,4 +1,4 @@ -name: Splunk protocol impersonation weak encryption simplerequest Unit Test +name: Splunk protocol impersonation weak encryption selfsigned Unit Test tests: - name: Splunk protocol impersonation weak encryption simplerequest file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt - source: "/opt/splunk/var/log/splunk/splunkd.log" + - file_name: splunk_protocol_impersonation_weak_encryption_selfsigned.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt + source: "/opt/splun/var/log/splunk/splunkd.log" sourcetype: splunkd + custom_index: _internal From fe2713e07729f3e9a06ccbeaf9a019e3647014ff Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 12:40:52 -0700 Subject: [PATCH 051/114] Fixed a detection which was using the wrong macro --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index ed8fa37722..97cdca736e 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' +search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. From b87dff2883cde8607cf073fb4e9c66cba80e3e41 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 16:01:21 -0700 Subject: [PATCH 052/114] Fixing name field in a detection test file --- ...k_protocol_impersonation_weak_encryption_selfsigned.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml index d97cf683a0..fb97c5ec66 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -1,6 +1,6 @@ name: Splunk protocol impersonation weak encryption selfsigned Unit Test tests: -- name: Splunk protocol impersonation weak encryption simplerequest +- name: Splunk protocol impersonation weak encryption selfsigned file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From c5386131392da3dd8a0f6a2e9cac8c7f00f88039 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 16:47:56 -0700 Subject: [PATCH 053/114] wrong detection file linked from test file. Fixed. --- ...k_protocol_impersonation_weak_encryption_selfsigned.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml index fb97c5ec66..4108a9dd4c 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -1,7 +1,7 @@ name: Splunk protocol impersonation weak encryption selfsigned Unit Test tests: - name: Splunk protocol impersonation weak encryption selfsigned - file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml + file: application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 6efcbd4b93c88f29ead032ee7080eda0c1ac5825 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 09:50:58 -0700 Subject: [PATCH 054/114] add risky command ML detection --- ...ky_command_abuse_ml_detection_baseline.yml | 71 +++++++++++++++++++ ...plunk_risky_command_abuse_ml_detection.yml | 67 +++++++++++++++++ ..._risky_command_abuse_ml_detection.test.yml | 20 ++++++ 3 files changed, 158 insertions(+) create mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml create mode 100644 detections/application/splunk_risky_command_abuse_ml_detection.yml create mode 100644 tests/application/splunk_risky_command_abuse_ml_detection.test.yml diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml new file mode 100644 index 0000000000..4175681ff2 --- /dev/null +++ b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml @@ -0,0 +1,71 @@ +name: Splunk Risky Command Abuse ML Detection Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +datamodel: +- Splunk_Audit +description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction + algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running + search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of + user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to + run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model + generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same + account of training this model will be used to perfeorm inference using this model for anomaly detection. + The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' +search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. + For large enterprises, training the model might take significant computing resources, and might + need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: ML model "risky_command_abuse" training is completed. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + detections: + - Splunk Risky Command Abuse ML Detection + diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml new file mode 100644 index 0000000000..709d3b7182 --- /dev/null +++ b/detections/application/splunk_risky_command_abuse_ml_detection.yml @@ -0,0 +1,67 @@ +name: Splunk Risky Command Abuse ML Detection +id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Anomaly +datamodel: +- Splunk_Audit +description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk + Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour + to detect whether a user has run searches containing risky keywords with abnormal long running time in the + past two hours, comparing with his/her past seven days history. ' +search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, + values(Search_Activity.search) as searches, count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | apply risky_command_abuse + | fields _time, user, searches, run_time, IsOutlier(run_time) + | rename IsOutlier(run_time) as isOutlier, _time as timestamp + | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: $user used abnormally long run time for searches with risky command. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml new file mode 100644 index 0000000000..c937b44717 --- /dev/null +++ b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml @@ -0,0 +1,20 @@ +name: Splunk Risky Command Abuse ML Detection Unit Test +tests: +- name: Splunk Risky Command Abuse ML Detection + file: application/splunk_risky_command_abuse_ml_detection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -1h + latest_time: now + baselines: + - name: Splunk Risky Command Abuse ML Detection Baseline + file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -7d + latest_time: now + attack_data: + - file_name: search_activity.json + data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + source: audittrail + sourcetype: audittrail + update_timestamp: true + custom_index: _audit From 3369d15d72ed75079b4b0e41ecc15d9f4bd2f070 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 10:40:47 -0700 Subject: [PATCH 055/114] rm wrong commit --- ...ky_command_abuse_ml_detection_baseline.yml | 71 ------------------- ...plunk_risky_command_abuse_ml_detection.yml | 67 ----------------- ..._risky_command_abuse_ml_detection.test.yml | 20 ------ 3 files changed, 158 deletions(-) delete mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml delete mode 100644 detections/application/splunk_risky_command_abuse_ml_detection.yml delete mode 100644 tests/application/splunk_risky_command_abuse_ml_detection.test.yml diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml deleted file mode 100644 index 4175681ff2..0000000000 --- a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection Baseline -id: 273df2f7-643a-451a-8d4d-637e39eadc87 -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Baseline -datamodel: -- Splunk_Audit -description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction - algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running - search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of - user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to - run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model - generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same - account of training this model will be used to perfeorm inference using this model for anomaly detection. - The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' -search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. - For large enterprises, training the model might take significant computing resources, and might - need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - context: - - Source:Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: ML model "risky_command_abuse" training is completed. - mitre_attack_id: - - T1203 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - detections: - - Splunk Risky Command Abuse ML Detection - diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml deleted file mode 100644 index 709d3b7182..0000000000 --- a/detections/application/splunk_risky_command_abuse_ml_detection.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection -id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Anomaly -datamodel: -- Splunk_Audit -description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk - Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour - to detect whether a user has run searches containing risky keywords with abnormal long running time in the - past two hours, comparing with his/her past seven days history. ' -search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, - values(Search_Activity.search) as searches, count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | apply risky_command_abuse - | fields _time, user, searches, run_time, IsOutlier(run_time) - | rename IsOutlier(run_time) as isOutlier, _time as timestamp - | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - context: - - Source:Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: $user used abnormally long run time for searches with risky command. - mitre_attack_id: - - T1203 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - \ No newline at end of file diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml deleted file mode 100644 index c937b44717..0000000000 --- a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection Unit Test -tests: -- name: Splunk Risky Command Abuse ML Detection - file: application/splunk_risky_command_abuse_ml_detection.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -1h - latest_time: now - baselines: - - name: Splunk Risky Command Abuse ML Detection Baseline - file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -7d - latest_time: now - attack_data: - - file_name: search_activity.json - data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit From 5a34e6c63309b19b7b17a394eb451b5dfe0b2b26 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 10:53:09 -0700 Subject: [PATCH 056/114] add risky command abuse ML detection --- ...ky_command_abuse_ml_detection_baseline.yml | 71 +++++++++++++++++++ ...plunk_risky_command_abuse_ml_detection.yml | 67 +++++++++++++++++ ..._risky_command_abuse_ml_detection.test.yml | 20 ++++++ 3 files changed, 158 insertions(+) create mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml create mode 100644 detections/application/splunk_risky_command_abuse_ml_detection.yml create mode 100644 tests/application/splunk_risky_command_abuse_ml_detection.test.yml diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml new file mode 100644 index 0000000000..4175681ff2 --- /dev/null +++ b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml @@ -0,0 +1,71 @@ +name: Splunk Risky Command Abuse ML Detection Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +datamodel: +- Splunk_Audit +description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction + algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running + search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of + user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to + run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model + generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same + account of training this model will be used to perfeorm inference using this model for anomaly detection. + The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' +search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. + For large enterprises, training the model might take significant computing resources, and might + need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: ML model "risky_command_abuse" training is completed. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + detections: + - Splunk Risky Command Abuse ML Detection + diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml new file mode 100644 index 0000000000..709d3b7182 --- /dev/null +++ b/detections/application/splunk_risky_command_abuse_ml_detection.yml @@ -0,0 +1,67 @@ +name: Splunk Risky Command Abuse ML Detection +id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Anomaly +datamodel: +- Splunk_Audit +description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk + Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour + to detect whether a user has run searches containing risky keywords with abnormal long running time in the + past two hours, comparing with his/her past seven days history. ' +search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, + values(Search_Activity.search) as searches, count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | apply risky_command_abuse + | fields _time, user, searches, run_time, IsOutlier(run_time) + | rename IsOutlier(run_time) as isOutlier, _time as timestamp + | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: $user used abnormally long run time for searches with risky command. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml new file mode 100644 index 0000000000..c937b44717 --- /dev/null +++ b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml @@ -0,0 +1,20 @@ +name: Splunk Risky Command Abuse ML Detection Unit Test +tests: +- name: Splunk Risky Command Abuse ML Detection + file: application/splunk_risky_command_abuse_ml_detection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -1h + latest_time: now + baselines: + - name: Splunk Risky Command Abuse ML Detection Baseline + file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -7d + latest_time: now + attack_data: + - file_name: search_activity.json + data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + source: audittrail + sourcetype: audittrail + update_timestamp: true + custom_index: _audit From cc852767f76d2ef701d757459224dedbeaef3b0a Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 14:04:04 -0500 Subject: [PATCH 057/114] Updated date --- .../splunk_digital_certificates_lack_of_encryption.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index b156555281..10b62666c5 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Anomaly datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. known_false_positives: None at this time From 41db7931fd39dc76e6e1f52cfe6c276237710fd6 Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 13 Jun 2022 16:05:21 -0400 Subject: [PATCH 058/114] removing notebooks --- ...ntial_dump_from_registry_via_reg_exe.ipynb | 141 -- ...oders_for_unusual_group_of_processes.ipynb | 317 --- ..._dump_lsass.exe_memory_using_comsvcs.ipynb | 179 -- notebooks/detect_kerberoasting__ssa.ipynb | 143 -- notebooks/detect_pass_hash__ssa.ipynb | 159 -- notebooks/phishing_detection_unit_test.ipynb | 222 -- ...e_parent_process_relationship_lolbas.ipynb | 330 --- notebooks/ssa___CredentialExtraction.ipynb | 1828 ----------------- ...ain_and_publish_phishing_email_model.ipynb | 564 ----- ...t_prohibited_apps_spawning_cmdprompt.ipynb | 204 -- ...usual_lolbas_in_short_period_of_time.ipynb | 268 --- 11 files changed, 4355 deletions(-) delete mode 100644 notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb delete mode 100644 notebooks/autoencoders_for_unusual_group_of_processes.ipynb delete mode 100644 notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb delete mode 100644 notebooks/detect_kerberoasting__ssa.ipynb delete mode 100644 notebooks/detect_pass_hash__ssa.ipynb delete mode 100644 notebooks/phishing_detection_unit_test.ipynb delete mode 100644 notebooks/rare_parent_process_relationship_lolbas.ipynb delete mode 100644 notebooks/ssa___CredentialExtraction.ipynb delete mode 100644 notebooks/train_and_publish_phishing_email_model.ipynb delete mode 100644 notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb delete mode 100644 notebooks/unusual_lolbas_in_short_period_of_time.ipynb diff --git a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb b/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb deleted file mode 100644 index 49c3f18b14..0000000000 --- a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb +++ /dev/null @@ -1,141 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Detect Credential Dumping via reg.exe T1003.002" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. MITRE ATT&CK" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.status.idle": "2020-10-19T19:55:18.824958Z", - "shell.execute_reply": "2020-10-19T19:55:18.824476Z", - "shell.execute_reply.started": "2020-10-19T19:55:15.531094Z" - }, - "scrolled": true - }, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
sysmoncmd_linevalueprocess_name
0{'EventTime': '2020-06-30 10:47:11', 'Hostname...\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKL...{\"EventTime\":\"2020-06-30 10:47:11\",\"Hostname\":...C:\\Windows\\System32\\cmd.exe
\n", - "
" - ], - "text/plain": [ - " sysmon ... process_name\n", - "0 {'EventTime': '2020-06-30 10:47:11', 'Hostname... ... C:\\Windows\\System32\\cmd.exe\n", - "\n", - "[1 rows x 4 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2\n", - "/* read attack dataset generated by Splunk Attack Range */\n", - "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.002/attack_data.txt\")\n", - "/* cast data as JSON */\n", - "| eval sysmon=from_json_object(cast(value, \"string\"))\n", - "/* read in the process name */\n", - "| eval process_name=ucast(map_get(sysmon, \"Image\"), \"string\", \"\") \n", - "/* filter on cmd.exe and reg.exe */\n", - "| where process_name LIKE \"%cmd.exe%\" OR process_name=\"%reg.exe%\"\n", - "/* read in the process name */\n", - "| eval cmd_line=ucast(map_get(sysmon, \"CommandLine\"), \"string\", \"\") \n", - "/* filter by any command line string that has the word save and matches targetted registry */\n", - "| where cmd_line != null AND \n", - " match_regex(cmd_line, /(?i)save\\s+/)=true AND\n", - " ( match_regex(cmd_line, /(?i)HKLM\\\\Security/)=true OR\n", - " match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true OR\n", - " match_regex(cmd_line, /(?i)HKLM\\\\System/)=true OR\n", - " match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\Security/)=true OR\n", - " match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true OR\n", - " match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\System/)=true \n", - " );" - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/autoencoders_for_unusual_group_of_processes.ipynb b/notebooks/autoencoders_for_unusual_group_of_processes.ipynb deleted file mode 100644 index 1f595d1ce8..0000000000 --- a/notebooks/autoencoders_for_unusual_group_of_processes.ipynb +++ /dev/null @@ -1,317 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "id": "3c1c8020-a12c-49ca-bbe6-4cedd473f48a", - "metadata": {}, - "source": [ - "## AutoEncoders to detect unusual groups of processes\n", - "\n", - "This notebook provides a reference we use for training [autoencoders](https://en.wikipedia.org/wiki/Autoencoder) to perform anomaly detection. Autoencoders are neural networks that attempt to faithfully reconstruct its input by first compressing it into a low dimensional encoding and then decompressing that encoding. These networks can be useful for anomaly detection because unusual data will have poor reconstructions. For cybersecurity, we can leverage anomaly detection to find possible attacks without having to perform significant feature engineering.\n", - "\n", - "
\n", - "\n", - "

Diagram by Michaela Massi, some rights reserved

\n", - "
\n", - "\n", - "For our purposes, we will build an autoencoder to identify anomalous groups of processes. We focus on processes with the prefix \\\\\\\\device\\Windows since attackers leverage these executables to [live off the land](https://conf.splunk.com/files/2019/slides/SEC1375.pdf). We use a technique called [feature hashing](https://scikit-learn.org/stable/modules/generated/sklearn.feature_extraction.FeatureHasher.html) to project the input (a map of process -> counts) into a [vector space](https://en.wikipedia.org/wiki/Vector_space) (convenient for machine learning).\n" - ] - }, - { - "cell_type": "code", - "execution_count": 8, - "id": "243c11af-0f58-4bb7-9bc6-1a0a88df8abe", - "metadata": {}, - "outputs": [], - "source": [ - "import numpy as np\n", - "from sklearn.feature_extraction import FeatureHasher\n", - "import tensorflow as tf\n", - "from sklearn.pipeline import Pipeline\n" - ] - }, - { - "cell_type": "markdown", - "id": "151ade38-3b59-482c-80f4-688f04cb2cf8", - "metadata": {}, - "source": [ - "### Training data\n", - "We will create a toy dataset that will contain which processes launched and how often during some time window (e.g. hour) correllated on one or more entities (e.g. user and machine, machine). For this demonstration, normal data will consist of a sample of four processes, of which, these four processes can occur 0-5 times within a sampling period. We assume independence between the processes. The below code block generates the data." - ] - }, - { - "cell_type": "code", - "execution_count": 38, - "id": "c17980df-e29a-4696-8b35-fa440864306f", - "metadata": {}, - "outputs": [], - "source": [ - "# Let's create some dummy data using processes\n", - "# commonly seen with the prefix C:\\Windows\n", - "num_samples = 10000\n", - "def create_dataset(num_samples=10000):\n", - " data = []\n", - " for i in range(num_samples):\n", - " datum = {'cmd.exe': np.round(np.random.uniform(high=5)),\n", - " 'conhost.exe': np.round(np.random.uniform(high=5)),\n", - " 'svchost.exe': np.round(np.random.uniform(high=5)),\n", - " 'werfault.exe': np.round(np.random.uniform(high=5))}\n", - " data.append(datum)\n", - " return data\n", - "\n", - "training_data = create_dataset()\n", - "test_data = create_dataset()\n" - ] - }, - { - "cell_type": "markdown", - "id": "2e5a163c-7f91-468f-bdb3-5c14a244945f", - "metadata": {}, - "source": [ - "### Transforming the data\n", - "We use a scikit learn pipeline to feature hash the input into a 16 dimensional vector. An example is shown of what the input and output look like." - ] - }, - { - "cell_type": "code", - "execution_count": 59, - "id": "63ca8129-0e0c-43c2-9ee6-b25c0a83390f", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Input data (process -> count map):\n", - "cmd.exe->3, conhost.exe->3, svchost.exe->5, werfault.exe->0\n", - "\n", - "\n", - "Vectorized input (16 dimensional)\n", - "[[-3. 2. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0.]]\n" - ] - } - ], - "source": [ - "pipe = Pipeline([('hasher', FeatureHasher(n_features=16))])\n", - "X = pipe.fit_transform(data)\n", - "\n", - "print(\"Input data (process -> count map):\")\n", - "print(\", \".join([f\"{k}->{int(v)}\" for (k, v) in data[0].items()]))\n", - "print(\"\\n\")\n", - "print(\"Vectorized input (16 dimensional)\")\n", - "print(X[0].todense())" - ] - }, - { - "cell_type": "markdown", - "id": "a941fd31-cb58-407d-b8bc-caea2229bb35", - "metadata": {}, - "source": [ - "## Network\n", - "We build our model using TensorFlow Keras. Since the input is already vectorized, we will stack vanilla dense layers with leaky ReLU activations to compress the input into a four dimensional vector encoding and than decompress back into the original." - ] - }, - { - "cell_type": "code", - "execution_count": 55, - "id": "05f287e6-4f5b-454e-8aa0-2d18f4c07612", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Model: \"model_2\"\n", - "_________________________________________________________________\n", - "Layer (type) Output Shape Param # \n", - "=================================================================\n", - "win_processes_hashed (InputL [(None, 16)] 0 \n", - "_________________________________________________________________\n", - "enc_1 (Dense) (None, 8) 136 \n", - "_________________________________________________________________\n", - "leaky_re_lu_8 (LeakyReLU) (None, 8) 0 \n", - "_________________________________________________________________\n", - "enc_2 (Dense) (None, 4) 36 \n", - "_________________________________________________________________\n", - "leaky_re_lu_9 (LeakyReLU) (None, 4) 0 \n", - "_________________________________________________________________\n", - "dec_1 (Dense) (None, 8) 40 \n", - "_________________________________________________________________\n", - "leaky_re_lu_10 (LeakyReLU) (None, 8) 0 \n", - "_________________________________________________________________\n", - "reconstruction (Dense) (None, 16) 144 \n", - "_________________________________________________________________\n", - "leaky_re_lu_11 (LeakyReLU) (None, 16) 0 \n", - "=================================================================\n", - "Total params: 356\n", - "Trainable params: 356\n", - "Non-trainable params: 0\n", - "_________________________________________________________________\n" - ] - } - ], - "source": [ - "ae_input_layer = tf.keras.layers.Input(shape=(16,), name=\"win_processes_hashed\")\n", - "ae_net = tf.keras.layers.Dense(8, name=\"enc_1\")(ae_input_layer)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_net = tf.keras.layers.Dense(4, name=\"enc_2\")(ae_net)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_net = tf.keras.layers.Dense(8, name=\"dec_1\")(ae_net)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_net = tf.keras.layers.Dense(16, name=\"reconstruction\")(ae_net)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_model = tf.keras.models.Model(ae_input_layer, ae_net)\n", - "ae_model.compile('adam', 'mse', ['mae'])\n", - "ae_model.summary()" - ] - }, - { - "cell_type": "code", - "execution_count": 56, - "id": "056ebac9-a317-4840-af1b-acfb2126f8be", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Epoch 1/10\n", - "1250/1250 [==============================] - 1s 549us/step - loss: 0.7084 - mae: 0.2522\n", - "Epoch 2/10\n", - "1250/1250 [==============================] - 1s 587us/step - loss: 0.0053 - mae: 0.0334\n", - "Epoch 3/10\n", - "1250/1250 [==============================] - 1s 550us/step - loss: 0.0012 - mae: 0.0171\n", - "Epoch 4/10\n", - "1250/1250 [==============================] - 1s 519us/step - loss: 4.5895e-04 - mae: 0.0092\n", - "Epoch 5/10\n", - "1250/1250 [==============================] - 1s 554us/step - loss: 1.9394e-04 - mae: 0.0063\n", - "Epoch 6/10\n", - "1250/1250 [==============================] - 1s 575us/step - loss: 1.0455e-04 - mae: 0.0047\n", - "Epoch 7/10\n", - "1250/1250 [==============================] - 1s 543us/step - loss: 6.1987e-05 - mae: 0.0038\n", - "Epoch 8/10\n", - "1250/1250 [==============================] - 1s 556us/step - loss: 3.1945e-05 - mae: 0.0030\n", - "Epoch 9/10\n", - "1250/1250 [==============================] - 1s 571us/step - loss: 2.4396e-05 - mae: 0.0028\n", - "Epoch 10/10\n", - "1250/1250 [==============================] - 1s 562us/step - loss: 2.3492e-05 - mae: 0.0027\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 56, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "# Training\n", - "ae_model.fit(X, X.todense(), epochs=10, batch_size=8)" - ] - }, - { - "cell_type": "markdown", - "id": "90dfef32-7da8-40d5-98ca-bf85b98f08ae", - "metadata": {}, - "source": [ - "### Anomaly detection\n", - "We use euclidean distance as a similarity function between the input and reconstruction. We expect that the distance between reconstruction and input will be small for normal data and large for anomalous data.\n", - "\n", - "First we apply the model and get the mean distance to the test data (which is generated the same way as the training data). We expect this to be small and it is." - ] - }, - { - "cell_type": "code", - "execution_count": 57, - "id": "01f81d20-aa84-4814-bf4b-ccc7f7e26dbe", - "metadata": {}, - "outputs": [ - { - "data": { - "text/plain": [ - "0.010183748708750814" - ] - }, - "execution_count": 57, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "X_test = pipe.transform(test_data)\n", - "np.average(np.sqrt(np.sum(np.square(X_test - ae_model.predict(X_test)), axis=1)))" - ] - }, - { - "cell_type": "markdown", - "id": "078db0c1-5313-452b-bdf9-984c5c2a7359", - "metadata": {}, - "source": [ - "Now let's apply the model to an unusual command that might be seen with [discovery](https://attack.mitre.org/tactics/TA0007/). Typically, we may see at most one of these processes in a sampling window. Notice how much larger the distance between the anomalous reconstruction and the mean normal reconstruction. Therefore, we can call out this unusual collection of processes in a short period of time to an analyst to get a disposition if this behavior is malicious. We may also call out this activity if there are other secondary or weakly predictive signals related to the same user or device." - ] - }, - { - "cell_type": "code", - "execution_count": 58, - "id": "5b27ab39-e1c3-4847-a90f-be3a03fb4e10", - "metadata": {}, - "outputs": [ - { - "data": { - "text/plain": [ - "5.716755530643157" - ] - }, - "execution_count": 58, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "unusual_command = [{\n", - " 'whoami.exe': 1,\n", - " 'net.exe': 3,\n", - " 'ver.exe': 1,\n", - " 'query.exe': 2,\n", - " 'sc.exe': 5}\n", - "]\n", - "X_u = pipe.transform(unusual_commands)\n", - "np.sqrt(np.sum(np.square(X_u - ae_model.predict(X_u))))" - ] - }, - { - "cell_type": "markdown", - "id": "9adfec39-e05d-417d-9a7a-a80b1e34a538", - "metadata": {}, - "source": [ - "### Summary\n", - "Cybersecurity has long employed anomaly detection to identify unusual activity that may be attributable to cyber attacks. This notebook shows how autoencoders, a deep neural network, can take a map of process counts during a sampling window and identify unusual groups. To accomplish this, we use feature hashing to vectorize the map of process -> counts. We train an autoencoder on the vectorized data. This network is able to identify unusual inputs that may be useful for discovering attacks." - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3.8.5" - } - }, - "nbformat": 4, - "nbformat_minor": 5 -} diff --git a/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb b/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb deleted file mode 100644 index 89cf7decf3..0000000000 --- a/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb +++ /dev/null @@ -1,179 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-09-24T04:06:52.928068Z", - "iopub.status.busy": "2020-09-24T04:06:52.927779Z", - "iopub.status.idle": "2020-09-24T04:06:52.934766Z", - "shell.execute_reply": "2020-09-24T04:06:52.934058Z", - "shell.execute_reply.started": "2020-09-24T04:06:52.928046Z" - } - }, - "source": [ - "# Detect Dump LSASS.exe Memory using comsvcs\n", - "\n", - "#### This search detects the memory of lsass.exe being dumped for offline credential theft attack.\n", - "\n", - "References: https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf\n", - "\n", - "Author: Jose Hernandez, Splunk\n", - "\n", - "Known false positives: None identified.\n", - "\n", - "Tags: Credential Dumping, T1003.003, Actions on Objectives, CIS 8, CIS 16\n", - "\n", - "Source: https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T19:49:47.098495Z", - "iopub.status.busy": "2020-10-19T19:49:47.098215Z", - "iopub.status.idle": "2020-10-19T19:49:50.310310Z", - "shell.execute_reply": "2020-10-19T19:49:50.309793Z", - "shell.execute_reply.started": "2020-10-19T19:49:47.098471Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "bb8622490e2143d2b9414eadac5441af", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
processmachineprocess_nameinput_eventtenanttimestamp
0\"c:\\windows\\system32\\rundll32.exe\" c:\\windows\\...eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG...rundll32.exe{'_tenant': 'test', '_time': '1600731080000', ...test2020-09-21 23:31:20
\n", - "
" - ], - "text/plain": [ - " process ... timestamp\n", - "0 \"c:\\windows\\system32\\rundll32.exe\" c:\\windows\\... ... 2020-09-21 23:31:20\n", - "\n", - "[1 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.001/windows-security-events_ssa.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval tenant=ucast(map_get(input_event, \"_tenant\"), \"string\", null),\n", - "machine=ucast(map_get(input_event, \"dest_ip_id\"), \"string\", null),\n", - "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)),\n", - "timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - "process=lower(ucast(map_get(input_event, \"process\"), \"string\", null))\n", - "| where process_name LIKE \"%rundll32.exe%\"\n", - "AND match_regex(process, /(?i)comsvcs.dll[,\\s]+MiniDump/)=true;" - ] - }, - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-09-24T04:07:41.132723Z", - "iopub.status.busy": "2020-09-24T04:07:41.132299Z", - "iopub.status.idle": "2020-09-24T04:07:41.142005Z", - "shell.execute_reply": "2020-09-24T04:07:41.141000Z", - "shell.execute_reply.started": "2020-09-24T04:07:41.132683Z" - } - }, - "source": [ - "# Dataset \n", - "This data set way generated via launching [atomic red team](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/) technique ID: T1003.01 and results were captured by the [Splunk Attack Range](https://github.com/splunk/attack_range).\n", - "This detection specifically address [atomic](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll)\n", - "Source: https://github.com/splunk/attack_data/blob/master/datasets/T1003.001/dataset.yml" - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/detect_kerberoasting__ssa.ipynb b/notebooks/detect_kerberoasting__ssa.ipynb deleted file mode 100644 index 1c905de653..0000000000 --- a/notebooks/detect_kerberoasting__ssa.ipynb +++ /dev/null @@ -1,143 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Detect Kerberoasting\n", - "### This is the SPL2 to test content: detections/endpoint/detect_kerberoasting__ssa.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-28T22:35:40.972663Z", - "iopub.status.busy": "2020-10-28T22:35:40.972286Z", - "iopub.status.idle": "2020-10-28T22:35:42.632374Z", - "shell.execute_reply": "2020-10-28T22:35:42.631440Z", - "shell.execute_reply.started": "2020-10-28T22:35:40.972629Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "2ea98fa914f748d487beaf1b4b188a4d", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timebodyentities
011191119TBDTBD
\n", - "
" - ], - "text/plain": [ - " end_time start_time body entities\n", - "0 1119 1119 TBD TBD" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n", - "| eval input_event=from_json_object(value)\n", - "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event, \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event, \"service_id\")\n", - "| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"0x17\"\n", - "| first_time_event cache_partitions=1 input_columns=\"EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID\"\n", - "| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\n", - "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n", - "| select start_time, end_time, entities, body \n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/detect_pass_hash__ssa.ipynb b/notebooks/detect_pass_hash__ssa.ipynb deleted file mode 100644 index e62bda7465..0000000000 --- a/notebooks/detect_pass_hash__ssa.ipynb +++ /dev/null @@ -1,159 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-14T00:24:08.027638Z", - "iopub.status.busy": "2020-10-14T00:24:08.027292Z", - "iopub.status.idle": "2020-10-14T00:24:08.030791Z", - "shell.execute_reply": "2020-10-14T00:24:08.030084Z", - "shell.execute_reply.started": "2020-10-14T00:24:08.027607Z" - } - }, - "source": [ - "# Detect Pass the Hash\n", - "### This is the SPL2 to test content: detections/endpoint/detect_pass_hash__ssa.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-28T22:35:49.966691Z", - "iopub.status.busy": "2020-10-28T22:35:49.966422Z", - "iopub.status.idle": "2020-10-28T22:35:51.544851Z", - "shell.execute_reply": "2020-10-28T22:35:51.543629Z", - "shell.execute_reply.started": "2020-10-28T22:35:49.966620Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "bc96630916c54e68bc29ac51a679c08e", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timebodyentities
066TBDTBD
188TBDTBD
\n", - "
" - ], - "text/plain": [ - " end_time start_time body entities\n", - "0 6 6 TBD TBD\n", - "1 8 8 TBD TBD" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n", - "| eval input_event=from_json_object(value)\n", - "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), LogonType=map_get(input_event, \"logon_type\"), LogonProcess=map_get(input_event, \"logon_process\"), ComputerName=map_get(input_event, \"dest_ip_primary_artifact\"), AccountName=map_get(input_event, \"dest_user_primary_artifact\")\n", - "| where (LogonType=\"3\" AND LogonProcess=\"NtLmSsp\" AND AccountName IS NOT NULL) OR (LogonType=\"9\" AND LogonProcess=\"seclogo\")\n", - "| first_time_event cache_partitions=1 input_columns=\"EventCode,LogonProcess,ComputerName\"\n", - "| where first_time_EventCode_LogonProcess_ComputerName\n", - "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n", - "| select start_time, end_time, entities, body \n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/phishing_detection_unit_test.ipynb b/notebooks/phishing_detection_unit_test.ipynb deleted file mode 100644 index 805579a80b..0000000000 --- a/notebooks/phishing_detection_unit_test.ipynb +++ /dev/null @@ -1,222 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Unit Test for Phishing Detection Model" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.status.idle": "2020-10-22T00:20:24.890053Z", - "shell.execute_reply": "2020-10-22T00:20:24.889186Z", - "shell.execute_reply.started": "2020-10-22T00:20:24.160138Z" - } - }, - "outputs": [], - "source": [ - "import numpy as np\n", - "import pandas as pd\n", - "\n", - "%load_ext spl2_kernel" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Extract first 10 records from the test dataset as unit test data" - ] - }, - { - "cell_type": "code", - "execution_count": 2, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-22T00:20:24.891960Z", - "iopub.status.busy": "2020-10-22T00:20:24.891603Z", - "iopub.status.idle": "2020-10-22T00:20:25.723640Z", - "shell.execute_reply": "2020-10-22T00:20:25.722836Z", - "shell.execute_reply.started": "2020-10-22T00:20:24.891925Z" - } - }, - "outputs": [ - { - "name": "stderr", - "output_type": "stream", - "text": [ - "/opt/conda/lib/python3.7/site-packages/dateutil/parser/_parser.py:1218: UnknownTimezoneWarning: tzname BST identified but not understood. Pass `tzinfos` argument in order to correctly return a timezone-aware datetime. In a future version, this will raise an exception.\n", - " category=UnknownTimezoneWarning)\n", - "/opt/conda/lib/python3.7/site-packages/dateutil/parser/_parser.py:1218: UnknownTimezoneWarning: tzname EDT identified but not understood. Pass `tzinfos` argument in order to correctly return a timezone-aware datetime. In a future version, this will raise an exception.\n", - " category=UnknownTimezoneWarning)\n", - "/opt/conda/lib/python3.7/site-packages/dateutil/parser/_parser.py:1218: UnknownTimezoneWarning: tzname EST identified but not understood. Pass `tzinfos` argument in order to correctly return a timezone-aware datetime. In a future version, this will raise an exception.\n", - " category=UnknownTimezoneWarning)\n" - ] - } - ], - "source": [ - "df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:10]\n", - "t = [i for i in range(10)]\n", - "df['_time'] = t\n", - "df.to_json('./detect_phishing_content.json', orient='records', lines=True)" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## SPL2 string to perform model inference for phishing detection" - ] - }, - { - "cell_type": "code", - "execution_count": 3, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-22T00:20:25.725171Z", - "iopub.status.busy": "2020-10-22T00:20:25.724951Z", - "iopub.status.idle": "2020-10-22T00:20:35.007199Z", - "shell.execute_reply": "2020-10-22T00:20:35.005911Z", - "shell.execute_reply.started": "2020-10-22T00:20:25.725149Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "5001252ce5834d52bb5668b0878c04c0", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timebodyentitiesprobability
044TBDTBD0.999498
\n", - "
" - ], - "text/plain": [ - " end_time start_time body entities probability\n", - "0 4 4 TBD TBD 0.999498" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 3, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2\n", - "| from read_json(\"s3://smle-experiments/datasets/phishing_email/detect_phishing_content.json\")\n", - "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", - "| where eventLine IS NOT NULL\n", - "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", - "| eval ml_in = for_each(\n", - " iterator(mvrange(1,129), \"i\"),\n", - " cast(map_get(mapC, substr(eventLine, i, 1)), \"float\") )\n", - "| apply_model connection_id=\"\" path=\"s3://smle-experiments/models/xlin/phishing_email\" name=\"phishing_email_v8\" \n", - "| eval probability = mvindex(ml_out, 0) \n", - "| where probability > 0.5\n", - "| eval start_time = _time, end_time = _time, entities = \"TBD\", body = \"TBD\"\n", - "| select probability, body, entities, start_time, end_time\n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3.7.8" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/rare_parent_process_relationship_lolbas.ipynb b/notebooks/rare_parent_process_relationship_lolbas.ipynb deleted file mode 100644 index 57d099f502..0000000000 --- a/notebooks/rare_parent_process_relationship_lolbas.ipynb +++ /dev/null @@ -1,330 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Rare Parent/Child Process Relationship\n", - "\n", - "An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries\n", - "\n", - "https://github.com/splunk/security-content/blob/unit_test_prohibited_apps_spawning_cmdprompt/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml" - ] - }, - { - "cell_type": "code", - "execution_count": 22, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T21:50:56.862479Z", - "iopub.status.busy": "2020-10-15T21:50:56.862220Z", - "iopub.status.idle": "2020-10-15T21:51:06.101230Z", - "shell.execute_reply": "2020-10-15T21:51:06.100748Z", - "shell.execute_reply.started": "2020-10-15T21:50:56.862456Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "38a2bbfe856f4bf797b49f98bb92e6be", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
inputstart_timedest_device_identitiesprocess_namequantileend_timelabelparent_processbodytimestampdest_user_id
07.6666672020-09-24 17:00:135gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]powershell.exe0.0000002020-09-24 17:00:13Truec:\\windows\\system32\\cmd.exeTBD2020-09-24 17:00:13NaN
11.1647252020-09-24 17:15:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0829192020-09-24 17:15:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:15:12NaN
21.1642282020-09-24 17:17:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0810372020-09-24 17:17:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:17:12NaN
31.1617422020-09-24 17:18:04IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]cmd.exe0.0837212020-09-24 17:18:04Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:18:04NaN
41.1582952020-09-24 17:18:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0576632020-09-24 17:18:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:18:12NaN
.......................................
17996.9184862020-09-25 19:46:23ZTQ/ltGlScpA4WGbfRJ0Xg==[ZTQ/ltGlScpA4WGbfRJ0Xg==]sc.exe0.0008432020-09-25 19:46:23Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 19:46:23NaN
18008.5672702020-09-25 16:49:46lQ+9FBHxYQK/q8qXcrTE9A==[lQ+9FBHxYQK/q8qXcrTE9A==]sc.exe0.0008412020-09-25 16:49:46Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 16:49:46NaN
18019.9914792020-09-25 16:50:30IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]sc.exe0.0033612020-09-25 16:50:30Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 16:50:30NaN
18025.4039342020-09-26 05:00:40OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==]cmd.exe0.0000002020-09-26 05:00:40Truec:\\program files\\splunkuniversalforwarder\\bin\\...TBD2020-09-26 05:00:40NaN
18030.0356482020-09-26 05:06:18OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...cmd.exe0.0000002020-09-26 05:06:18Truec:\\windows\\system32\\cmd.exeTBD2020-09-26 05:06:18rXYtTmzIXq56PqQ+iNO/xw==
\n", - "

1804 rows × 12 columns

\n", - "
" - ], - "text/plain": [ - " input ... dest_user_id\n", - "0 7.666667 ... NaN\n", - "1 1.164725 ... NaN\n", - "2 1.164228 ... NaN\n", - "3 1.161742 ... NaN\n", - "4 1.158295 ... NaN\n", - "... ... ... ...\n", - "1799 6.918486 ... NaN\n", - "1800 8.567270 ... NaN\n", - "1801 9.991479 ... NaN\n", - "1802 5.403934 ... NaN\n", - "1803 0.035648 ... rXYtTmzIXq56PqQ+iNO/xw==\n", - "\n", - "[1804 rows x 12 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 22, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", - "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n", - "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n", - "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", - "| where parent_process!=null \n", - "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", - "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", - "| rename output as input \n", - "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" value=\"input\" window=604800000L \n", - "| where label AND quantile<0.1 AND (process_name=\"powershell.exe\" OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\" OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\" OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\" OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\" OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\" OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\")\n", - "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/ssa___CredentialExtraction.ipynb b/notebooks/ssa___CredentialExtraction.ipynb deleted file mode 100644 index ca3f6cef56..0000000000 --- a/notebooks/ssa___CredentialExtraction.ipynb +++ /dev/null @@ -1,1828 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Credential Extraction" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### FGdump" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:06:20.305699Z", - "iopub.status.busy": "2020-10-21T18:06:20.305420Z", - "iopub.status.idle": "2020-10-21T18:06:35.431304Z", - "shell.execute_reply": "2020-10-21T18:06:35.430703Z", - "shell.execute_reply.started": "2020-10-21T18:06:20.305672Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "ce9b4b5a9ad04012bca3a6f99f1650b5", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-14 20:57:28-v[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...cachedump64.exeC:\\Users\\Administrator\\Downloads\\fgdump-2.1.0-...2020-09-14 20:57:28c:\\users\\admini~1\\appdata\\local\\temp{'_tenant': 'test', '_time': '1600117048000', ...2020-09-14 20:57:28
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " match_regex(parent_process_name, /(?i)fgdump.exe/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 12, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T07:31:33.752874Z", - "iopub.status.busy": "2020-10-19T07:31:33.752605Z", - "iopub.status.idle": "2020-10-19T07:31:36.961722Z", - "shell.execute_reply": "2020-10-19T07:31:36.960969Z", - "shell.execute_reply.started": "2020-10-19T07:31:33.752852Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "8ed2f12e58284468be940ca472904ca6", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-14 20:57:28\"\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\cachedu...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...cachedump64.exeC:\\Windows\\System32\\services.exe2020-09-14 20:57:28c:\\users\\admini~1\\appdata\\local\\temp{'_tenant': 'test', '_time': '1600117048000', ...2020-09-14 20:57:28
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 12, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND parent_process_name != null AND\n", - " match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true AND\n", - " match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND\n", - " match_regex(process_path, /(?i)\\\\Temp/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-s/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 4, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:43:38.657607Z", - "iopub.status.busy": "2020-10-19T06:43:38.657338Z", - "iopub.status.idle": "2020-10-19T06:43:43.943417Z", - "shell.execute_reply": "2020-10-19T06:43:43.942731Z", - "shell.execute_reply.started": "2020-10-19T06:43:38.657582Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "f54e0d67a72f4885b5728174656682dc", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameend_timeprocess_pathinput_eventtimestamp
02020-09-14 20:57:28-v[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...cachedump64.exe2020-09-14 20:57:28c:\\users\\admini~1\\appdata\\local\\temp{'_tenant': 'test', '_time': '1600117048000', ...2020-09-14 20:57:28
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n", - "\n", - "[1 rows x 8 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 4, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND process_path != null AND\n", - " match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND\n", - " match_regex(process_path, /(?i)\\\\Temp/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-v/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### LaZagne" - ] - }, - { - "cell_type": "code", - "execution_count": 209, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-16T11:11:37.602675Z", - "iopub.status.busy": "2020-10-16T11:11:37.602388Z", - "iopub.status.idle": "2020-10-16T11:11:38.897829Z", - "shell.execute_reply": "2020-10-16T11:11:38.897200Z", - "shell.execute_reply.started": "2020-10-16T11:11:37.602651Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "ea6d405d5dbb45fbbdcccd118a5a74fa", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timeentitiesprocess_nameinput_eventtimestamp
02020-09-12 01:25:412020-09-12 01:25:41[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...lazagne.exe{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
12020-09-12 01:25:412020-09-12 01:25:41[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...lazagne.exe{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "1 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "\n", - "[2 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 209, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLazagneCredDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n", - "| where process_name != null AND\n", - " match_regex(process_name, /(?i)lazagne.exe/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 5, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:15.842408Z", - "iopub.status.busy": "2020-10-19T06:44:15.842154Z", - "iopub.status.idle": "2020-10-19T06:44:17.835759Z", - "shell.execute_reply": "2020-10-19T06:44:17.835188Z", - "shell.execute_reply.started": "2020-10-19T06:44:15.842387Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "d20cc7f7621b4e449419b4216187807c", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-12 01:25:412020-09-12 01:25:41lazagne all -oA -output lazDump.txt[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
12020-09-12 01:25:412020-09-12 01:25:41lazagne all -oA -output lazDump.txt[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "1 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "\n", - "[2 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 5, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLazagneCredDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " match_regex(cmd_line, /(?i)all\\s+\\-oA\\s+\\-output/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### PowerSploit/DSInternals" - ] - }, - { - "cell_type": "code", - "execution_count": 6, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:32.330847Z", - "iopub.status.busy": "2020-10-19T06:44:32.330579Z", - "iopub.status.idle": "2020-10-19T06:44:34.317758Z", - "shell.execute_reply": "2020-10-19T06:44:34.317168Z", - "shell.execute_reply.started": "2020-10-19T06:44:32.330825Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "55e657aa20074cbaa58dfbcc45ca5ec0", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-17 18:59:052020-09-17 18:59:05powershell -command \"\"Get-ADDBAccount -All -D...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369145000', ...2020-09-17 18:59:05
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-17 18:59:05 ... 2020-09-17 18:59:05\n", - "\n", - "[1 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 6, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logPowerShellModule.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\|]+/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-16T18:40:38.543645Z", - "iopub.status.busy": "2020-10-16T18:40:38.543331Z", - "iopub.status.idle": "2020-10-16T18:40:38.546643Z", - "shell.execute_reply": "2020-10-16T18:40:38.545902Z", - "shell.execute_reply.started": "2020-10-16T18:40:38.543617Z" - } - }, - "source": [ - "### Windows-native debuggers: NTKD, LiveKD" - ] - }, - { - "cell_type": "code", - "execution_count": 7, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:40.113042Z", - "iopub.status.busy": "2020-10-19T06:44:40.112773Z", - "iopub.status.idle": "2020-10-19T06:44:42.191978Z", - "shell.execute_reply": "2020-10-19T06:44:42.191344Z", - "shell.execute_reply.started": "2020-10-19T06:44:40.113019Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "71f723f491ba4ba29302108a6b3119b8", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameend_timeinput_eventtimestamp
02020-09-14 17:31:20\"C:\\Program Files (x86)\\Windows Kits\\10\\Debugg...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...ntkd.exe2020-09-14 17:31:20{'_tenant': 'test', '_time': '1600104680000', ...2020-09-14 17:31:20
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 17:31:20 ... 2020-09-14 17:31:20\n", - "\n", - "[1 rows x 7 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 7, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logNtkdDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND \n", - " ( \n", - " match_regex(process_name, /^(?i)ntkd\\.exe/)=true OR\n", - " match_regex(process_name, /^(?i)kd\\.exe/)=true \n", - " ) AND \n", - " match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "raw", - "metadata": {}, - "source": [ - "------------------------------------------------\n", - "SAME DETECTION ON LiveKD's DATASET\n", - "------------------------------------------------" - ] - }, - { - "cell_type": "code", - "execution_count": 9, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:58.570342Z", - "iopub.status.busy": "2020-10-19T06:44:58.570056Z", - "iopub.status.idle": "2020-10-19T06:44:59.753230Z", - "shell.execute_reply": "2020-10-19T06:44:59.752699Z", - "shell.execute_reply.started": "2020-10-19T06:44:58.570317Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "ef72e8a6d72d41b3b8f3c231d0c74e24", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameend_timeinput_eventtimestamp
02020-09-12 23:25:47kd.exe -z C:\\Windows\\livekd.dmp[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...kd.exe2020-09-12 23:25:47{'_tenant': 'test', '_time': '1599953147000', ...2020-09-12 23:25:47
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-12 23:25:47 ... 2020-09-12 23:25:47\n", - "\n", - "[1 rows x 7 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 9, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLiveKDFullKernelDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND \n", - " ( \n", - " match_regex(process_name, /^(?i)ntkd\\.exe/)=true OR\n", - " match_regex(process_name, /^(?i)kd\\.exe/)=true \n", - " ) AND \n", - " match_regex(cmd_line, /(?i)\\-z\\s+/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 10, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:45:22.643424Z", - "iopub.status.busy": "2020-10-19T06:45:22.643152Z", - "iopub.status.idle": "2020-10-19T06:45:23.764872Z", - "shell.execute_reply": "2020-10-19T06:45:23.764356Z", - "shell.execute_reply.started": "2020-10-19T06:45:22.643401Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "83fc3507d11841139f30b4ff3d3fcf6c", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeinput_eventtimestamp
02020-09-12 23:25:44\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...conhost.exeC:\\Program Files (x86)\\Windows Kits\\10\\Debugge...2020-09-12 23:25:44{'_tenant': 'test', '_time': '1599953144000', ...2020-09-12 23:25:44
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-12 23:25:44 ... 2020-09-12 23:25:44\n", - "\n", - "[1 rows x 8 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 10, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLiveKDFullKernelDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND parent_process_name != null AND process_name != null AND \n", - " ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR\n", - " match_regex(parent_process_name, /(?i)livekd\\.exe/)=true\n", - " ) AND\n", - " match_regex(process_name, /(?i)conhost\\.exe/)=true AND\n", - " match_regex(cmd_line, /(?i)0xffffffff/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-ForceV1/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### PowerSploit modules" - ] - }, - { - "cell_type": "code", - "execution_count": 4, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:29:40.267475Z", - "iopub.status.busy": "2020-10-21T18:29:40.267191Z", - "iopub.status.idle": "2020-10-21T18:29:45.564872Z", - "shell.execute_reply": "2020-10-21T18:29:45.564202Z", - "shell.execute_reply.started": "2020-10-21T18:29:40.267450Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "b33e383c863940a1968742c8886d5a37", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-17 18:59:052020-09-17 18:59:05powershell -command \"\"Import-Module PowerSplo...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369145000', ...2020-09-17 18:59:05
12020-09-17 18:59:042020-09-17 18:59:04powershell -command \"\"Install-SSP; Install-Se...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369144000', ...2020-09-17 18:59:04
22020-09-17 18:59:032020-09-17 18:59:03powershell -command \"\"Get-IPAddress; Convert-...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369143000', ...2020-09-17 18:59:03
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-17 18:59:05 ... 2020-09-17 18:59:05\n", - "1 2020-09-17 18:59:04 ... 2020-09-17 18:59:04\n", - "2 2020-09-17 18:59:03 ... 2020-09-17 18:59:03\n", - "\n", - "[3 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 4, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllPowerSploitModulesWithOldNames.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-SiteListPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-SPNTicket/)=true OR\n", - " match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-VaultCredential/)=true OR\n", - " match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true \n", - " )\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### DSInternals" - ] - }, - { - "cell_type": "code", - "execution_count": 5, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:29:49.499740Z", - "iopub.status.busy": "2020-10-21T18:29:49.499462Z", - "iopub.status.idle": "2020-10-21T18:29:50.727426Z", - "shell.execute_reply": "2020-10-21T18:29:50.726855Z", - "shell.execute_reply.started": "2020-10-21T18:29:49.499716Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "d1d8d5a4f8184b47a32e8d3fa710d245", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-17 18:59:02powershell -command \"\"Install-Module DSIntern...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...powershell.exeC:\\Windows\\System32\\cmd.exe2020-09-17 18:59:02c:\\windows\\system32\\windowspowershell\\v1.0{'_tenant': 'test', '_time': '1600369142000', ...2020-09-17 18:59:02
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-17 18:59:02 ... 2020-09-17 18:59:02\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 5, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllDSInternalsModules.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND ( \n", - " match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADReplAccount/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-BootKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\n", - " ) \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "raw", - "metadata": {}, - "source": [ - "------------------------------------------------\n", - "DSInternals credential converters and decryptors\n", - "------------------------------------------------" - ] - }, - { - "cell_type": "code", - "execution_count": 6, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:29:54.881202Z", - "iopub.status.busy": "2020-10-21T18:29:54.880838Z", - "iopub.status.idle": "2020-10-21T18:29:58.846049Z", - "shell.execute_reply": "2020-10-21T18:29:58.845520Z", - "shell.execute_reply.started": "2020-10-21T18:29:54.881168Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "f130a73e8b384980ac1998d2fea445f7", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=4.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-17 18:59:02powershell -command \"\"Install-Module DSIntern...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...powershell.exeC:\\Windows\\System32\\cmd.exe2020-09-17 18:59:02c:\\windows\\system32\\windowspowershell\\v1.0{'_tenant': 'test', '_time': '1600369142000', ...2020-09-17 18:59:02
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-17 18:59:02 ... 2020-09-17 18:59:02\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 6, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllDSInternalsModules.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND ( \n", - " match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-LMHash/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-UnicodePassword/)=true\n", - " ) \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### Mimikatz" - ] - }, - { - "cell_type": "code", - "execution_count": 7, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:30:01.383334Z", - "iopub.status.busy": "2020-10-21T18:30:01.383060Z", - "iopub.status.idle": "2020-10-21T18:30:03.190514Z", - "shell.execute_reply": "2020-10-21T18:30:03.189720Z", - "shell.execute_reply.started": "2020-10-21T18:30:01.383303Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "04cf984d9740472dba04265122bc549d", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-11 23:45:192020-09-11 23:45:19mimikatz \"\"kerberos::ptt kerberos::golden ker...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599867919000', ...2020-09-11 23:45:19
12020-09-11 23:45:212020-09-11 23:45:21mimikatz \"\"crypto::capi crypto::cng crypto::c...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599867921000', ...2020-09-11 23:45:21
22020-09-11 23:45:172020-09-11 23:45:17mimikatz \"\"lsadump::sam lsadump::secrets lsa...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599867917000', ...2020-09-11 23:45:17
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-11 23:45:19 ... 2020-09-11 23:45:19\n", - "1 2020-09-11 23:45:21 ... 2020-09-11 23:45:21\n", - "2 2020-09-11 23:45:17 ... 2020-09-11 23:45:17\n", - "\n", - "[3 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 7, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllMimikatzModules.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND (\n", - " match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR\n", - " match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR\n", - " match_regex(cmd_line, /(?i)kerberos::list/)=true OR\n", - " match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::sam/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::cache/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::trust/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true \n", - " )\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/train_and_publish_phishing_email_model.ipynb b/notebooks/train_and_publish_phishing_email_model.ipynb deleted file mode 100644 index b78a41adf2..0000000000 --- a/notebooks/train_and_publish_phishing_email_model.ipynb +++ /dev/null @@ -1,564 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Train Model" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": {}, - "outputs": [], - "source": [ - "import numpy as np\n", - "import pandas as pd\n", - "\n", - "from tensorflow.keras.layers import Dense, Embedding, LSTM, SpatialDropout1D\n", - "from tensorflow.keras.models import Sequential\n", - "from tensorflow.keras.callbacks import EarlyStopping\n", - "from tensorflow.keras import metrics" - ] - }, - { - "cell_type": "code", - "execution_count": 2, - "metadata": {}, - "outputs": [], - "source": [ - "maxLen = 128\n", - "epochs = 50\n", - "dim_embedding = 50\n", - "batch_size = 256\n", - "dropout_rate = 0.25\n", - "num_LSTM_cell = 64\n", - "trainDataFileName = 's3://smle-experiments/datasets/phishing_email/train.json'" - ] - }, - { - "cell_type": "code", - "execution_count": 3, - "metadata": {}, - "outputs": [], - "source": [ - "xTrain = []\n", - "yTrain = []\n", - "df = pd.read_json(trainDataFileName, lines = True)\n", - "for idx, row in df.iterrows():\n", - " label = np.zeros(1)\n", - " if row['isPhishing'] == 'True':\n", - " label[0] = 1\n", - " yTrain.append(label)\n", - " aMessage = row['From'] + ' ' + row['Subject'] + ' ' + row['Content']\n", - " anEvent = np.array([32]*maxLen)\n", - " p = 0\n", - " for c in aMessage:\n", - " v = ord(c)\n", - " if v < 32 or v > 126:\n", - " continue\n", - " anEvent[p] = v\n", - " p += 1\n", - " if p >= maxLen:\n", - " break\n", - " xTrain.append(anEvent)\n", - "xTrain = np.array(xTrain)\n", - "yTrain = np.array(yTrain)" - ] - }, - { - "cell_type": "code", - "execution_count": 4, - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/keras/initializers.py:119: calling RandomUniform.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/resource_variable_ops.py:1630: calling BaseResourceVariable.__init__ (from tensorflow.python.ops.resource_variable_ops) with constraint is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "If using Keras pass *_constraint arguments to layers.\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/nn_impl.py:183: where (from tensorflow.python.ops.array_ops) is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Use tf.where in 2.0, which has the same broadcast rule as np.where\n", - "Train on 40000 samples, validate on 10000 samples\n", - "Epoch 1/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.1514 - acc: 0.9740 - val_loss: 0.0912 - val_acc: 0.9817\n", - "Epoch 2/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0990 - acc: 0.9796 - val_loss: 0.0904 - val_acc: 0.9817\n", - "Epoch 3/50\n", - "40000/40000 [==============================] - 43s 1ms/sample - loss: 0.0884 - acc: 0.9796 - val_loss: 0.0726 - val_acc: 0.9828\n", - "Epoch 4/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0726 - acc: 0.9798 - val_loss: 0.0640 - val_acc: 0.9830\n", - "Epoch 5/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0667 - acc: 0.9812 - val_loss: 0.0621 - val_acc: 0.9855\n", - "Epoch 6/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0665 - acc: 0.9813 - val_loss: 0.0598 - val_acc: 0.9849\n", - "Epoch 7/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0651 - acc: 0.9816 - val_loss: 0.0529 - val_acc: 0.9824\n", - "Epoch 8/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0532 - acc: 0.9830 - val_loss: 0.0393 - val_acc: 0.9889\n", - "Epoch 9/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0474 - acc: 0.9844 - val_loss: 0.0428 - val_acc: 0.9891\n", - "Epoch 10/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0419 - acc: 0.9891 - val_loss: 0.0359 - val_acc: 0.9912\n", - "Epoch 11/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0385 - acc: 0.9886 - val_loss: 0.0271 - val_acc: 0.9922\n", - "Epoch 12/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0369 - acc: 0.9894 - val_loss: 0.0251 - val_acc: 0.9937\n", - "Epoch 13/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0299 - acc: 0.9921 - val_loss: 0.0255 - val_acc: 0.9933\n", - "Epoch 14/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0242 - acc: 0.9942 - val_loss: 0.0181 - val_acc: 0.9948\n", - "Epoch 15/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0210 - acc: 0.9958 - val_loss: 0.0195 - val_acc: 0.9957\n", - "Epoch 16/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0179 - acc: 0.9961 - val_loss: 0.0146 - val_acc: 0.9965\n", - "Epoch 17/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0168 - acc: 0.9964 - val_loss: 0.0147 - val_acc: 0.9969\n", - "Epoch 18/50\n", - "40000/40000 [==============================] - 43s 1ms/sample - loss: 0.0179 - acc: 0.9959 - val_loss: 0.0125 - val_acc: 0.9968\n", - "Epoch 19/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0262 - acc: 0.9909 - val_loss: 0.0168 - val_acc: 0.9971\n", - "Epoch 20/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0169 - acc: 0.9961 - val_loss: 0.0128 - val_acc: 0.9971\n", - "Epoch 21/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0163 - acc: 0.9962 - val_loss: 0.0134 - val_acc: 0.9966\n", - "Epoch 22/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0165 - acc: 0.9966 - val_loss: 0.0121 - val_acc: 0.9971\n", - "Epoch 23/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0143 - acc: 0.9967 - val_loss: 0.0115 - val_acc: 0.9970\n", - "Epoch 24/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0266 - acc: 0.9909 - val_loss: 0.0170 - val_acc: 0.9971\n", - "Epoch 25/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0158 - acc: 0.9964 - val_loss: 0.0119 - val_acc: 0.9971\n", - "Epoch 26/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0190 - acc: 0.9951 - val_loss: 0.0146 - val_acc: 0.9959\n", - "Epoch 27/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0173 - acc: 0.9956 - val_loss: 0.0134 - val_acc: 0.9973\n", - "Epoch 28/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0120 - acc: 0.9970 - val_loss: 0.0130 - val_acc: 0.9972\n", - "Epoch 29/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0125 - acc: 0.9970 - val_loss: 0.0123 - val_acc: 0.9973\n", - "Epoch 30/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0121 - acc: 0.9970 - val_loss: 0.0127 - val_acc: 0.9969\n" - ] - } - ], - "source": [ - "model = Sequential()\n", - "model.add(Embedding(128, dim_embedding, input_length=maxLen))\n", - "model.add(SpatialDropout1D(dropout_rate))\n", - "model.add(LSTM(num_LSTM_cell, dropout=dropout_rate, recurrent_dropout=dropout_rate))\n", - "model.add(Dense(1, activation='sigmoid'))\n", - "model.compile(optimizer='adam', loss='binary_crossentropy', metrics=['accuracy'])\n", - "history = model.fit(xTrain, yTrain, epochs=epochs, batch_size=batch_size, validation_split=0.2, \n", - " callbacks=[EarlyStopping(monitor='val_loss',patience=7, min_delta=0.00001)])" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Publish Model" - ] - }, - { - "cell_type": "code", - "execution_count": 5, - "metadata": {}, - "outputs": [], - "source": [ - "import os\n", - "import smle\n", - "import warnings\n", - "\n", - "warnings.filterwarnings('ignore')\n", - "from smle.context import Context\n", - "cwd = os.getcwd()\n", - "\n", - "config = { \n", - " 'username': '',\n", - " \n", - " 'model_storage_type': 's3', \n", - " 'model_storage_address': \"s3.us-west-2.amazonaws.com\",\n", - " 'model_storage_bucket': 'smle-experiments',\n", - " 'model_storage_access_key': '',\n", - " 'model_storage_secret_key': '',\n", - " 'model_storage_secure': False,\n", - "}\n", - "smle_context = Context(config)\n", - "\n", - "%load_ext spl2_kernel" - ] - }, - { - "cell_type": "code", - "execution_count": 6, - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/smle/onnx.py:88: export_saved_model (from tensorflow.python.keras.saving.saved_model_experimental) is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Please use `model.save(..., save_format=\"tf\")` or `tf.keras.models.save_model(..., save_format=\"tf\")`.\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling GlorotUniform.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling Orthogonal.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling Zeros.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/saved_model/signature_def_utils_impl.py:253: build_tensor_info (from tensorflow.python.saved_model.utils_impl) is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "This function will only be available through the v1 compatibility library as tf.compat.v1.saved_model.utils.build_tensor_info or tf.compat.v1.saved_model.build_tensor_info.\n", - "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Predict: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Train: ['train']\n", - "INFO:tensorflow:Signatures INCLUDED in export for Eval: None\n", - "WARNING:tensorflow:Export includes no default signature!\n", - "INFO:tensorflow:No assets to save.\n", - "INFO:tensorflow:No assets to write.\n", - "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Predict: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Train: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Eval: ['eval']\n", - "WARNING:tensorflow:Export includes no default signature!\n", - "INFO:tensorflow:No assets to save.\n", - "INFO:tensorflow:No assets to write.\n", - "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Predict: ['serving_default']\n", - "INFO:tensorflow:Signatures INCLUDED in export for Train: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Eval: None\n", - "INFO:tensorflow:No assets to save.\n", - "INFO:tensorflow:No assets to write.\n", - "INFO:tensorflow:SavedModel written to: /tmp/phishing_email/saved_model.pb\n" - ] - } - ], - "source": [ - "model_path = \"models/phishing_email\"\n", - "model_name = \"phishing_email\"\n", - "\n", - "!rm -rf /tmp/{model_name}\n", - "sample_data = pd.read_csv('s3://smle-experiments/datasets/phishing_email/sample_file.csv')\n", - "smle_context.publish(model, model_name=model_name, path = model_path, sample= sample_data)" - ] - }, - { - "cell_type": "code", - "execution_count": 7, - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Metadata:\n", - "{'inputFields': [{'name': 'embedding_input:0',\n", - " 'size': 128,\n", - " 'type': 'floatTensor'}],\n", - " 'modelName': 'phishing_email',\n", - " 'outputFields': [{'name': 'dense/Sigmoid:0',\n", - " 'size': 1,\n", - " 'type': 'floatTensor'}]}\n", - "\n", - "ONNX model specs:\n", - "{'inputs': [{'name': 'embedding_input:0',\n", - " 'shape': ['unk__236', 128],\n", - " 'type': 'tensor(float)'}],\n", - " 'outputs': [{'name': 'dense/Sigmoid:0',\n", - " 'shape': ['unk__237', 1],\n", - " 'type': 'tensor(float)'}]}\n" - ] - } - ], - "source": [ - "import json\n", - "import onnxruntime as rt\n", - "from pprint import pprint\n", - "\n", - "\n", - "def inspect_model(dir_path, model_name):\n", - "\n", - " metadata = json.load(open(dir_path + \"metadata.json\"))\n", - " \n", - " print(\"Metadata:\")\n", - " pprint(metadata)\n", - " print()\n", - " \n", - " model_path = dir_path + model_name + \".onnx\"\n", - " sess = rt.InferenceSession(model_path)\n", - "\n", - " onnx_inputs = sess.get_inputs()\n", - " onnx_outputs = sess.get_outputs()\n", - "\n", - " inputs = [{\"name\": node.name, \"type\": node.type, \"shape\": node.shape} for node in onnx_inputs]\n", - " outputs = [{\"name\": node.name, \"type\": node.type, \"shape\": node.shape} for node in onnx_outputs]\n", - " onnx_model_specs = {\"inputs\": inputs, \"outputs\": outputs}\n", - " print(\"ONNX model specs:\")\n", - " \n", - " pprint(onnx_model_specs)\n", - "\n", - "\n", - "inspect_model(\"/tmp/\", model_name)" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - }, - { - "cell_type": "code", - "execution_count": 8, - "metadata": {}, - "outputs": [], - "source": [ - "%%spl2_add_params from_python\n", - "phishing_email = dict(\n", - " model_path = \"s3://smle-experiments/models/phishing_email\",\n", - " model_name = \"phishing_email\",\n", - " input_field = \"embedding_input:0\",\n", - ")" - ] - }, - { - "cell_type": "code", - "execution_count": 9, - "metadata": {}, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "6aa0cfe6342a4e59b0ff9a68f1de5596", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
eventLineprobability
0karem ahmed <karemahmed-18@hotmail.fr> PLEA...[0.9720325]
1nkomo robert <nkomo002@5fm.za.com> FAMILY R...[0.9768889]
2Mrs Mariam Taylor <familyboxjanetfamilybo...[0.9780622999999999]
3Mr.Fred Chima <fredi@fastermail.com> busi...[0.97669697]
4Alexander Afadia <eeaesq@123.com> Please repl...[0.9775347999999999]
.........
82Comfort Somba. <comfort_somba11@yahoo.fr> F...[0.97327405]
83bintu pat <pat_bintu004@hotmail.com> TRUSTI...[0.96824765]
84FR RICHARD DAVID <unofice@katamail.com> FRO...[0.96306074]
85<joseph_m333@micasilla.net> Farmers Greetings...[0.97275084]
86MRS. LARISA SOSNITSKAYA <larisasosnkayapawou...[0.9751048999999999]
\n", - "

87 rows × 2 columns

\n", - "
" - ], - "text/plain": [ - " eventLine probability\n", - "0 karem ahmed PLEA... [0.9720325]\n", - "1 nkomo robert FAMILY R... [0.9768889]\n", - "2 Mrs Mariam Taylor busi... [0.97669697]\n", - "4 Alexander Afadia Please repl... [0.9775347999999999]\n", - ".. ... ...\n", - "82 Comfort Somba. F... [0.97327405]\n", - "83 bintu pat TRUSTI... [0.96824765]\n", - "84 FR RICHARD DAVID FRO... [0.96306074]\n", - "85 Farmers Greetings... [0.97275084]\n", - "86 MRS. LARISA SOSNITSKAYA " - ] - }, - "execution_count": 9, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 -q phishing_email\n", - "| from read_json(\"s3://smle-experiments/datasets/phishing_email/test.json\")\n", - "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", - "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", - "| eval 'embedding_input:0' = for_each(\n", - " iterator(mvrange(1,129), \"i\"),\n", - " cast(map_get(mapC, substr(eventLine, i, 1)), \"float\") )\n", - "| apply_model connection_id=\"\" path=\"$model_path\" name=\"$model_name\" \n", - "| rename 'dense/Sigmoid:0' AS probability \n", - "| where mvindex(probability, 0) > 0.5 \n", - "| select eventLine, probability \n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": 10, - "metadata": {}, - "outputs": [], - "source": [ - "df = _.df" - ] - }, - { - "cell_type": "code", - "execution_count": 11, - "metadata": { - "scrolled": true - }, - "outputs": [ - { - "data": { - "text/plain": [ - "\" karem ahmed PLEASE VERY URGENT. FROM THE DESK OF Mr,KAREM AHMED.BILL AND EXCHANGE MANAGER,BANK OF AFRICA (B.O.A) OUAGADOUGOU,BURKINA FASO WEST AFRICA.PHONE CONTACT 00226.78.89.77.34DEAR FRIEND,I know you may be surprise to recieve this e-mail ; I got your contact address from the internet while I was searching for my friend that has similar name with you.I am the manager of bill and exchange BANK OF AFRICA (B.O.A) at foreign remittance department.There is a business I would want you to champion for me, in my department I discovered an abandoned sum of ($31.500.000 U.S) thirty one million five hundred thousands US dollars)In an account that belongs to one of our foreign customer who died along with his entire family on 25TH JULY, 2000 CONCORDE PLANE CRASH [Flight AF4590] with the whole passengers aboard. The name of the deceased man was(MR.ANDREAS SCHRANNER from Munich Germany)N.B. In other for you to believe me honestly, visit the web site to enable you know whether we can work together, below is the website. http://news.bbc.co.uk/1/hi/world/europe/859479.stmYou have to understand that I come crossed this huge amount of money when I was arranging the departmental customers file to submit to the bank management for the annual audit of the year.Since we got information about his death, we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines, but unfortunately we learnt that all his supposed next of kin's or relation died alongside with him at the plane crash leaving nobody behind for the claim.It is therefore upon this discovery that I now decided to make this business proposal to you and release the money to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and I dont want this money to go into the Bank treasury as unclaimed Bill.The Banking law and guideline here stipulates that if such money remained unclaimed after some years, the money will be transferred into the Bank treasury as unclaimed fund.The request of foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner and a Burkina citizen cannot stand as next of kin to a foreigner.In fact I could have done this deal alone but because of my position in this country as a civil servant (A Banker), we are not allowed to operate any foreign account and would eventually raise an eye brow on my side during the time of transfer because I work in the same bank. This is the actual reason why it will require a second party or fellow who will forward claims as the next of kin to the Bank and also present a foreign account where he will need the money to be re-transferred into on his request as it may be after due verification and clarification by the correspondent branch of the bank where the whole money will be remitted from to your own designation bank account.I dont want this money to go into the Bank treasury as unclaimed Bill, I agree that 30 % of this money will be for you as foreign partner, in respect to the provision of a foreign account, 10 % will be set aside for expenses incurred during the business and 60 % would be for me. There after I will visit your country for disbursement according to the percentages indicated. Therefore to enable immediate transfer of this fund to you as arranged, you must apply first to the bank as relations or next of kin of the deceased indicating your bank name, your bank account number, your private telephone and fax number for easy and effective communication and location where in the money will be remitted.All modalities of this transaction have been carefully worked out and once started will not take more than fourteen (14) working days, with your full support.This transaction is 100% risk free. it involve no any implication and no any precaution there after.Upon receipt of your reply, I will send to you by fax or email the text of the application. I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer.You should contact me immediately as soon as you receive this letterreply to thi box. at;Trusting to hear from you immediately.Yours faithfully,Mr,KAREM AHMEDBill and exchange manager,BANK OF AFRICA_________________________________________________________________Personnalisez votre Messenger avec Live.com http://www.windowslive.fr/livecom/ \"" - ] - }, - "execution_count": 11, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "df.iloc[0]['eventLine']" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3.7.6" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb b/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb deleted file mode 100644 index 94160fe672..0000000000 --- a/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb +++ /dev/null @@ -1,204 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Detect Prohibited Applications Spawning cmd exe Unit Test\n", - "\n", - "#### This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`\n", - "\n", - "Source: https://github.com/splunk/security-content/blob/develop/detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 92, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T00:21:43.611728Z", - "iopub.status.busy": "2020-10-15T00:21:43.611411Z", - "iopub.status.idle": "2020-10-15T00:21:43.615239Z", - "shell.execute_reply": "2020-10-15T00:21:43.614712Z", - "shell.execute_reply.started": "2020-10-15T00:21:43.611700Z" - } - }, - "outputs": [], - "source": [ - "import json\n", - "data='{\"process_path\":\"c:\\\\\\windows\\\\\\system32\",\"process_name\":\"cmd.exe\",\"process\":\"C:\\\\\\Windows\\\\\\system32\\\\\\cmd.exe\",\"parent_process_name\":\"C:\\\\\\Program Files\\\\\\Microsoft Office\\\\\\winword.exe\",\"dest_user_id\":\"eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZmFjdCI6ImFkbWluaXN0cmF0b3IiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiV0lORE9XU19BQ0NPVU5UX05BTUUifQ\",\"dest_device_id\":\"eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydGlmYWN0Ijoid2luLWRjLTY1NjUwNzEiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiRE5TIn0\",\"_time\":\"1602004409000\"}'\n", - "json.loads(data)\n", - "with open(\"detect_prohibited_applications_spawning_cmd_exe.json\", \"w\") as outfile:\n", - " outfile.write(data)" - ] - }, - { - "cell_type": "code", - "execution_count": 94, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T00:22:58.225618Z", - "iopub.status.busy": "2020-10-15T00:22:58.225357Z", - "iopub.status.idle": "2020-10-15T00:22:59.362013Z", - "shell.execute_reply": "2020-10-15T00:22:59.361508Z", - "shell.execute_reply.started": "2020-10-15T00:22:58.225596Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "c2d2b32468a04f8a8bb7eafd174e5c5d", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timedest_device_idfield0entitiesprocess_nameend_timedest_user_idparent_processbodyvalueinput_eventtimestamp
02020-10-06 17:13:29eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG...winword.exe[eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFyd...cmd.exe2020-10-06 17:13:29eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZm...c:\\program files\\microsoft office\\winword.exeTBD{\"process_path\":\"c:\\\\windows\\\\system32\",\"proce...{'process_path': 'c:\\windows\\system32', 'proce...2020-10-06 17:13:29
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-10-06 17:13:29 ... 2020-10-06 17:13:29\n", - "\n", - "[1 rows x 12 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 94, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/detect_prohibited_applications_spawning_cmd_exe.json\")\n", - "| eval input_event=from_json_object(value)\n", - "\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null))\n", - "| eval process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - "parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)),\n", - "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\n", - "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", - "| where process_name=\"cmd.exe\"\n", - "| rex field=parent_process \"(?[^\\\\\\\\]+)$\"\n", - "| where field0=\"winword.exe\" OR\n", - " field0=\"excel.exe\" OR\n", - " field0=\"outlook.exe\" OR\n", - " field0=\"powerpnt.exe\" OR\n", - " field0=\"visio.exe\" OR\n", - " field0=\"mspub.exe\" OR\n", - " field0=\"acrobat.exe\" OR\n", - " field0=\"acrord32.exe\" OR\n", - " field0=\"chrome.exe\" OR\n", - " field0=\"iexplore.exe\" OR\n", - " field0=\"opera.exe\" OR\n", - " field0=\"firefox.exe\" OR\n", - " field0=\"java.exe\" OR\n", - " field0=\"powershell.exe\"\n", - "| eval start_time=timestamp,\n", - "end_time=timestamp,\n", - "entities=mvappend(dest_device_id, dest_user_id),\n", - "body=\"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/unusual_lolbas_in_short_period_of_time.ipynb b/notebooks/unusual_lolbas_in_short_period_of_time.ipynb deleted file mode 100644 index d277a654e0..0000000000 --- a/notebooks/unusual_lolbas_in_short_period_of_time.ipynb +++ /dev/null @@ -1,268 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# More than usual number of LOLBAS applications in short time period\n", - "\n", - "Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine.\n" - ] - }, - { - "cell_type": "code", - "execution_count": 3, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T21:42:08.429572Z", - "iopub.status.busy": "2020-10-15T21:42:08.429312Z", - "iopub.status.idle": "2020-10-15T21:42:15.742444Z", - "shell.execute_reply": "2020-10-15T21:42:15.741830Z", - "shell.execute_reply.started": "2020-10-15T21:42:08.429549Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "c27fe9ebed854de3b9d45c5f643cbbdb", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timewindow_triggerentitiesquantileend_timewindow_startlabelbodydevicelolbas_countertimestamp
02020-09-24 17:10:001600967399999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:10:001600967100000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==72020-09-24 17:10:00
12020-09-24 17:45:001600969499999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:45:001600969200000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==92020-09-24 17:45:00
22020-09-24 17:55:001600970099999[IaNYgFTNQvyVmJNuPr58dQ==]12020-09-24 17:55:001600969800000TrueTBDIaNYgFTNQvyVmJNuPr58dQ==92020-09-24 17:55:00
32020-09-24 18:00:001600970399999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-24 18:00:001600970100000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==92020-09-24 18:00:00
42020-09-24 22:20:001600985999999[zMnUW93edd+Q+ovwebxbRw==]12020-09-24 22:20:001600985700000TrueTBDzMnUW93edd+Q+ovwebxbRw==52020-09-24 22:20:00
52020-09-24 23:30:001600990199999[ZTQ/ltGlScpA4WGbfRJ0Xg==]12020-09-24 23:30:001600989900000TrueTBDZTQ/ltGlScpA4WGbfRJ0Xg==52020-09-24 23:30:00
62020-09-25 14:25:001601043899999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-25 14:25:001601043600000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==122020-09-25 14:25:00
72020-09-26 05:05:001601096699999[OWUYaWKrJeuOY71+TXoqiw==]12020-09-26 05:05:001601096400000TrueTBDOWUYaWKrJeuOY71+TXoqiw==382020-09-26 05:05:00
\n", - "
" - ], - "text/plain": [ - " start_time window_trigger ... lolbas_counter timestamp\n", - "0 2020-09-24 17:10:00 1600967399999 ... 7 2020-09-24 17:10:00\n", - "1 2020-09-24 17:45:00 1600969499999 ... 9 2020-09-24 17:45:00\n", - "2 2020-09-24 17:55:00 1600970099999 ... 9 2020-09-24 17:55:00\n", - "3 2020-09-24 18:00:00 1600970399999 ... 9 2020-09-24 18:00:00\n", - "4 2020-09-24 22:20:00 1600985999999 ... 5 2020-09-24 22:20:00\n", - "5 2020-09-24 23:30:00 1600990199999 ... 5 2020-09-24 23:30:00\n", - "6 2020-09-25 14:25:00 1601043899999 ... 12 2020-09-25 14:25:00\n", - "7 2020-09-26 05:05:00 1601096699999 ... 38 2020-09-26 05:05:00\n", - "\n", - "[8 rows x 11 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 3, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", - " | eval device=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\n", - " process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null))\n", - " | where process_name==\"regsvcs.exe\" OR process_name==\"ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\" OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\" OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\" OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\" OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\" OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\" OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\" OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"msconfig.exe\" \n", - " | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) \n", - " | eval lolbas_counter=lolbas_counter*1.0\n", - " | rename window_end as timestamp\n", - " | adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"device\" window=2419200000L\n", - " | where label AND quantile>0.99 \n", - " | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), body = \"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} From 1bc7d9b0b0fca4048e0cf34ad32757a40169d9cb Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 15:47:30 -0500 Subject: [PATCH 059/114] Add workbook --- workbooks/splunk_psa_0622.json | 100 +++++++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 workbooks/splunk_psa_0622.json diff --git a/workbooks/splunk_psa_0622.json b/workbooks/splunk_psa_0622.json new file mode 100644 index 0000000000..7fa22dc320 --- /dev/null +++ b/workbooks/splunk_psa_0622.json @@ -0,0 +1,100 @@ +{ + "name": "Splunk PSA Hunting 06/22", + "is_default": false, + "phases": [ + { + "name": "SVD-2022-0601", + "order": 1, + "tasks": [ + { + "name": "Identify hosts running pre-9.0 versions of Splunk", + "order": 1, + "description": "This vulnerability affects all installs of Splunk prior to version 9.0. The first thing we need to do is identify which of these hosts are present within an environment. Run the \"ESCU - Splunk Protocol Impersonation Weak Encryption Configuration\" hunting search. \n\n\n Examine the output of the query. Hosts need to be running 9.0 or later in order to have the configuration options available. Additionally, several configuration stanzas need to be set in order to ensure the host properly validates TLS certificates. You can view the full list here: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk_Python_modules \n\n\n While the hunting search returns the values to check for in server.conf and web.conf, there is also an environment variable set in $SPLUNK_HOME/etc/splunk-launch.conf, which is not available from the search. This needs to be manually checked for (and configured) on each host.", + "playbooks": [], + "actions": ["run query"] + + }, + { + "name": "Look for usage of Default Splunk TLS Certificates", + "order": 2, + "description": "As part of auditing your environment, use data collected from Splunk Stream, Zeek, or a similar data source that provides insight into encrypted traffic and the TLS certificates in use within your environment. You can use the \"ESCU - Splunk Identified SSL TLS Certificates\" hunting search to identify hosts using the default, out of the box Splunk TLS certificates, which should not be considered secure.", + "playbooks": [], + "actions": ["run query"] + }, + { + "name":"Look for lack of encryption", + "order": 3, + "description": "You can use the \"ESCU - Splunk Digital Certificates Lack of Encryption\" search to look for hosts that are forwarding data without the use of TLS. Hosts that are not using TLS to forward data to Splunk are the most likely to need additional scrutiny to ensure these devices are configured in a secure manner. Additionally, you can remove the 'ssl=\"false\"' segment from the beginning of this search in order to get a larger picture of what devices within your environment are forwarding data.", + "playbooks": [], + "actions": ["run query"] + }, + { + "name": "Look for simpleRequest TLS errors", + "order": 4, + "description": "Use the \"ESCU - Splunk Protocol Impersonation Weak Encryption simpleRequest\" hunting search. This search helps you to identify instances in which the SimpleRequest library that ships as part of Splunk's Python failed to validate a certificate.", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name":"SVD-2022-0602", + "order": 2, + "tasks":[ + { + "name": "Look for usage of Default Splunk TLS Certificates", + "order": 1, + "description":"As part of auditing your environment, use data collected from Splunk Stream, Zeek, or a similar data source that provides insight into encrypted traffic and the TLS certificates in use within your environment. You can use the \"ESCU - Splunk Identified SSL TLS Certificates\" hunting search to identify hosts using the default, out of the box Splunk TLS certificates, which should not be considered secure.", + "playbooks": [], + "actions": ["run query"] + }, + { + "name": "Look for Default TLS Certificate logged errors", + "order": 2, + "description": "Use the \"ESCU - Splunk Protocol Impersonation Weak Encryption SelfSigned\" hunting search. This search helps you identify devices using self signed certificates which emit warnings starting in version 9.0 of Splunk Enterprise.", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name": "SVD-2022-0603", + "order": 3, + "tasks": [ + { + "name": "Check Splunk Infrastructure versions", + "order": 1, + "description": "Use the \"ESCU - Splunk Digital Certificates Infrastructure Version\" hunting search. This allows you to check the \"SslConfig\" stanza for each host's server.conf as well as its version. For more details about the settings, you can read the docs here: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communications", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name": "SVD-2022-0604", + "order": 4, + "tasks": [ + { + "name": "Risky Command Hunting", + "order": 1, + "description": "Use the \"ESCU - Splunk Command and Scripting Interpreter Risky Commands\" hunting search. The Splunk platform includes several SPL commands that can be used to take data that may be restricted by index based RBAC or other means, and make it available to others. This hunting search uses the Splunk Audit datamodel to query the audit trail for your Splunk environment to look for the usage of these commands. The usage of these in particular is not necessarily a sign of trouble and some are used often, but after figuring out what is normal for your environment and who runs what and how often, the data presented will make more sense.", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name": "SVD-2022-0607", + "order": 5, + "tasks": [ + { + "name": "Forwarder Bundle Download Hunting", + "order": 1, + "description": "Use the \"ESCU - Splunk Process Injection Forwarder Bundle Downloads\" hunting search. This search presents you with all of the apps downloaded by forwarders from your deployment server, as well as what serverclass the clients belong to. This vulnerability relates to unauthenticated clients being able to download forwarder bundles. Look for instances in which apps have been downloaded but a client does not have an associated serverclass.", + "playbooks": [], + "actions": ["run query"] + } + ] + } + ] +} \ No newline at end of file From 42f1e731f7db0f34d264fe0bee2ea0032f8544b2 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 15:47:56 -0500 Subject: [PATCH 060/114] Updated description --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index e2de4532d5..5ad85dac05 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -5,13 +5,12 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. known_false_positives: None at this time. references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html tags: analytic_story: - Splunk Vulnerabilites From 61a6c11e2dd43a4cc4744ad6da14ef2cae11d01a Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:11:44 -0600 Subject: [PATCH 061/114] Update splunk_command_and_scripting_interpreter_delete_usage.yml --- ...ommand_and_scripting_interpreter_delete_usage.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 6fdeed8d30..62fc569c6c 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -13,8 +13,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. -known_false_positives: False positives may be present if this command is used as a common practive. Filter as needed. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Acceleration is recommended. +known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -27,17 +27,17 @@ tags: - CIS 16 cve: - CVE-2022-32154 - confidence: 100 + confidence: 80 context: - Source:Endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log - impact: 100 + impact: 90 kill_chain_phases: - Actions on Objectives message: Delete command has ran by $user$ and should be reviewed. mitre_attack_id: - - T1213 + - T1059 nist: - DE.CM observable: @@ -57,6 +57,6 @@ tags: - Search_Activity.user - Search_Activity.savedsearch_name - Search_Activity.search_type - risk_score: 100 + risk_score: 72 security_domain: audit From e30ad6bd31023739486224661e46e9a18f94240e Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 16:17:07 -0500 Subject: [PATCH 062/114] Updated How To Implement --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 5ad85dac05..4372fc3ac5 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -7,10 +7,11 @@ type: Hunting datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' -how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: None at this time. references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilites From 5414d530fec12032b17a26da01d1eb889a25e0b2 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:18:21 -0600 Subject: [PATCH 063/114] Update splunk_command_and_scripting_interpreter_risky_commands.yml --- ...mand_and_scripting_interpreter_risky_commands.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 9d68135295..02faf6770e 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -7,9 +7,9 @@ type: Hunting datamodel: - Splunk_Audit description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. - A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. - During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity. + Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. + A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. + During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type @@ -17,8 +17,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. -known_false_positives: False positives will be present until properly filtered by Username, search name, and so forth. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +known_false_positives: False positives will be present until properly filtered by Username and search name. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -41,7 +41,7 @@ tags: - Actions on Objectives message: A risky Splunk command has ran by $user$ and should be reviewed. mitre_attack_id: - - T1213 + - T1059 nist: - DE.CM observable: From 3afeaa8a3b14a4eb36e4b59b74437a0a4e3a4d88 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:39:43 -0600 Subject: [PATCH 064/114] Update splunk_command_and_scripting_interpreter_delete_usage.yml --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 62fc569c6c..89545817db 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Acceleration is recommended. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning From 46cd276adfeaaaf94f1cdd49c936491216e34167 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:40:49 -0600 Subject: [PATCH 065/114] Update splunk_identified_ssl_tls_certificates.yml --- .../network/splunk_identified_ssl_tls_certificates.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index d20ed006b3..d11510bc9e 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -4,12 +4,11 @@ version: 1 date: '2022-05-25' author: Michael Haag, Splunk type: Hunting -datamodel: -- Network_Traffic +datamodel: [] description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`' -how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. references: - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL From 66d7814fed158021ab059a1f67a529754ed89639 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:43:18 -0600 Subject: [PATCH 066/114] Update splunk_identified_ssl_tls_certificates.yml --- .../network/splunk_identified_ssl_tls_certificates.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index d11510bc9e..e02cf855b1 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -23,12 +23,12 @@ tags: cve: - CVE-2022-32151 - CVE-2022-32152 - confidence: 100 + confidence: 70 context: - Source:Application Log dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log - impact: 100 + impact: 60 kill_chain_phases: - Reconnaissance message: The following $dest$ is using the self signed Splunk certificate. @@ -52,5 +52,5 @@ tags: - ssl_subject - host - sourcetype - risk_score: 100 + risk_score: 42 security_domain: network From a0967fe429a181d2db2a2acd21fec7cfb0b7fb92 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 16:49:49 -0500 Subject: [PATCH 067/114] Workbook how_to_implement & references --- ...lunk_command_and_scripting_interpreter_risky_commands.yml | 3 ++- .../splunk_digital_certificates_infrastructure_version.yml | 3 ++- .../splunk_digital_certificates_lack_of_encryption.yml | 5 +++-- ..._protocol_impersonation_weak_encryption_configuration.yml | 3 ++- ...unk_protocol_impersonation_weak_encryption_selfsigned.yml | 3 ++- ..._protocol_impersonation_weak_encryption_simplerequest.yml | 3 ++- .../network/splunk_identified_ssl_tls_certificates.yml | 3 ++- 7 files changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 02faf6770e..6444d94980 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -17,10 +17,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: False positives will be present until properly filtered by Username and search name. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 620e753281..3edd0e1940 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -7,11 +7,12 @@ type: Hunting datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' -how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 10b62666c5..4d9492c2b2 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -7,11 +7,12 @@ type: Anomaly datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' -how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. +how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: None at this time references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 1eeca76ac5..7476ab31a4 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -8,10 +8,11 @@ datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 97cdca736e..543086a3f4 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -7,11 +7,12 @@ type: Hunting datamodel: [] search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. references: - https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 07c3137ce6..e349aafe6b 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -7,11 +7,12 @@ type: Hunting datamodel: [] search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: - https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index e02cf855b1..f5c2e8840e 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -8,10 +8,11 @@ datamodel: [] description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`' -how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. references: - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities From be1c572724a04b483b77a18725c2d048eb633c6c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 16:50:50 -0500 Subject: [PATCH 068/114] Fixed field --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 7476ab31a4..cd0df357c2 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -7,8 +7,8 @@ type: Hunting datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' -how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html From 9a266a78ee7483e65ad652e618bb84b74c75dd36 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 15:33:12 -0700 Subject: [PATCH 069/114] update per review comments --- ...ng_interpreter_risky_spl_mltk_baseline.yml | 84 +++++++++++++++++++ ...ky_command_abuse_ml_detection_baseline.yml | 71 ---------------- ..._scripting_interpreter_risky_spl_mltk.yml} | 33 +++++--- ...pting_interpreter_risky_spl_mltk.test.yml} | 10 +-- 4 files changed, 109 insertions(+), 89 deletions(-) create mode 100644 baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml delete mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml rename detections/application/{splunk_risky_command_abuse_ml_detection.yml => splunk_command_and_scripting_interpreter_risky_spl_mltk.yml} (55%) rename tests/application/{splunk_risky_command_abuse_ml_detection.test.yml => splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml} (56%) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml new file mode 100644 index 0000000000..c1c27acae4 --- /dev/null +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -0,0 +1,84 @@ +name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +datamodel: +- Splunk_Audit +description: 'This search is to build a per user command and scripting risky SPL detection model using MLTK + DensityFunction algorithm based on audit log data of Splunk apps. The model is built from past 7 days users + history of running search commands from + https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, + and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of + outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that + boundary is smaller than 0.1%. This search should be scheduled to run at least as frequently as every 7 days. + The name of ML model generated is "risky_command_abuse" and should be configured to be globally shared (not + private) in MLTK app as ducumented here: + https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps + unless the same account of training this model will be used to perfeorm inference using this model for anomaly + detection. ' +search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' +how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky + SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/ + and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might + take significant computing resources. It might requires dedicated search head. The underlined machine learning + algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as + max_fit_time, max_groups, etc. More details of achieving optmal performance abd configuring DensityFunction + parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply + Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points + to build a good bseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better + suit users' violation policy and their usage environment. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density + function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + cve: + - CVE-2022-32154 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: ML model "risky_command_abuse" training is completed. + mitre_attack_id: + - T1059 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + detections: + - Splunk Command and Scripting Interpreter Risky SPL MLTK + diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml deleted file mode 100644 index 4175681ff2..0000000000 --- a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection Baseline -id: 273df2f7-643a-451a-8d4d-637e39eadc87 -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Baseline -datamodel: -- Splunk_Audit -description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction - algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running - search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of - user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to - run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model - generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same - account of training this model will be used to perfeorm inference using this model for anomaly detection. - The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' -search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. - For large enterprises, training the model might take significant computing resources, and might - need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - context: - - Source:Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: ML model "risky_command_abuse" training is completed. - mitre_attack_id: - - T1203 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - detections: - - Splunk Risky Command Abuse ML Detection - diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml similarity index 55% rename from detections/application/splunk_risky_command_abuse_ml_detection.yml rename to detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 709d3b7182..632f466415 100644 --- a/detections/application/splunk_risky_command_abuse_ml_detection.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -1,4 +1,4 @@ -name: Splunk Risky Command Abuse ML Detection +name: Splunk Command and Scripting Interpreter Risky SPL MLTK id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca version: 1 date: '2022-05-27' @@ -6,14 +6,16 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk - Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour - to detect whether a user has run searches containing risky keywords with abnormal long running time in the - past two hours, comparing with his/her past seven days history. ' +description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk Command + and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user + has run searches containing risky SPL from this list + https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga + with abnormal long running time in the past one hour, comparing with his/her past seven days history. This search + uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier_= 0.0)' search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) + AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) @@ -21,10 +23,13 @@ search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.tota | apply risky_command_abuse | fields _time, user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp - | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. + | where isOutlier>0.5 + | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' +how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ + and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model + needs to be buillt using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density + function model, false positives can occur, incorrectly labeling a long running search as potentially risky. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -35,6 +40,8 @@ tags: - CIS 3 - CIS 6 confidence: 40 + cve: + - CVE-2022-32154 context: - Source:Endpoint dataset: @@ -42,9 +49,9 @@ tags: impact: 50 kill_chain_phases: - Actions on Objectives - message: $user used abnormally long run time for searches with risky command. + message: Abnormally long run time for risk SPL command seen by user $user. mitre_attack_id: - - T1203 + - T1059 nist: - DE.AE observable: @@ -64,4 +71,4 @@ tags: - Search_Activity.search_type risk_score: 20 security_domain: audit - \ No newline at end of file + diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml similarity index 56% rename from tests/application/splunk_risky_command_abuse_ml_detection.test.yml rename to tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml index c937b44717..00c80c42b7 100644 --- a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml @@ -1,13 +1,13 @@ -name: Splunk Risky Command Abuse ML Detection Unit Test +name: Splunk Command and Scripting Interpreter Risky SPL MLTK Unit Test tests: -- name: Splunk Risky Command Abuse ML Detection - file: application/splunk_risky_command_abuse_ml_detection.yml +- name: Splunk Command and Scripting Interpreter Risky SPL MLTK + file: splunk_command_and_scripting_interpreter_risky_spl_mltk.yml pass_condition: '| stats count | where count > 0' earliest_time: -1h latest_time: now baselines: - - name: Splunk Risky Command Abuse ML Detection Baseline - file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml + - name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline + file: baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml pass_condition: '| stats count | where count > 0' earliest_time: -7d latest_time: now From 99cbc03fd5b503fbb22019a2d68143508b5989ed Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:47:06 -0700 Subject: [PATCH 070/114] fixedhosts --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 543086a3f4..9fed47ed14 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -31,7 +31,7 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Splunk default issued certificate at host$ + message: Splunk default issued certificate at $host$ mitre_attack_id: - T1588.004 nist: From 7b2dc90afb16e614137d4a8b7b7adaa68852c0ad Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:51:53 -0700 Subject: [PATCH 071/114] fixedsearchdescription --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index e349aafe6b..2e29e2cbeb 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' -description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. +description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: From 000e75040d6866d4f4b414e14a9d60b06ab6b116 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 16:39:09 -0700 Subject: [PATCH 072/114] fix typos --- ...d_scripting_interpreter_risky_spl_mltk_baseline.yml | 10 +++++----- ...ommand_and_scripting_interpreter_risky_spl_mltk.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index c1c27acae4..73b8c90c1f 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -12,9 +12,9 @@ description: 'This search is to build a per user command and scripting risky SPL https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that - boundary is smaller than 0.1%. This search should be scheduled to run at least as frequently as every 7 days. - The name of ML model generated is "risky_command_abuse" and should be configured to be globally shared (not - private) in MLTK app as ducumented here: + boundary is smaller than 0.1%, indicating a risky use of these commands. This search should be scheduled to run + at least as frequently as every 7 days. The name of machine learning model generated is "risky_command_abuse" + and should be configured to be globally shared (not private) in MLTK app as ducumented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perfeorm inference using this model for anomaly detection. ' @@ -31,10 +31,10 @@ how_to_implement: The corresponding detection of using this model is "Splunk Com and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might requires dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as - max_fit_time, max_groups, etc. More details of achieving optmal performance abd configuring DensityFunction + max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points - to build a good bseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better + to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment. known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 632f466415..d3c5e5b32f 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -6,12 +6,12 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk Command +description: 'This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga - with abnormal long running time in the past one hour, comparing with his/her past seven days history. This search - uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier_= 0.0)' + with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search + uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)' search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") From a247079b45b8fb2d07ce7095f7c5c6c54466bb2f Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 17:15:45 -0700 Subject: [PATCH 073/114] update and typos --- ...ipting_interpreter_risky_spl_mltk_baseline.yml | 15 ++++++++------- ...d_and_scripting_interpreter_risky_spl_mltk.yml | 2 +- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index 73b8c90c1f..bda1136ce5 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -12,11 +12,12 @@ description: 'This search is to build a per user command and scripting risky SPL https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that - boundary is smaller than 0.1%, indicating a risky use of these commands. This search should be scheduled to run - at least as frequently as every 7 days. The name of machine learning model generated is "risky_command_abuse" - and should be configured to be globally shared (not private) in MLTK app as ducumented here: + boundary is smaller than 0.1% (three 9s - 0.999), indicating a risky use of these commands. Users can adjust + this threshold 0.1% to higher or lower value depending on desired false positive report rate. This search should + be scheduled to run at least as frequently as every 7 days. The name of machine learning model generated is + "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps - unless the same account of training this model will be used to perfeorm inference using this model for anomaly + unless the same account of training this model will be used to perform inference using this model for anomaly detection. ' search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") @@ -29,8 +30,8 @@ search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.tota how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might - take significant computing resources. It might requires dedicated search head. The underlined machine learning - algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as + take significant computing resources. It might require dedicated search head. The underlined machine learning + algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points @@ -51,7 +52,7 @@ tags: cve: - CVE-2022-32154 context: - - Source:Endpoint + - Source: Endpoint dataset: - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt impact: 50 diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index d3c5e5b32f..66251ae54c 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -27,7 +27,7 @@ search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.tota | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model - needs to be buillt using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. + needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. references: From c701be5699cc8efe880c884e6e382c4f42275f7c Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Tue, 14 Jun 2022 00:30:38 -0700 Subject: [PATCH 074/114] for review comment --- ...ng_interpreter_risky_spl_mltk_baseline.yml | 24 ++++++++++--------- ...d_scripting_interpreter_risky_spl_mltk.yml | 7 +++--- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index bda1136ce5..9ebafeb336 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -6,29 +6,31 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Baseline datamodel: - Splunk_Audit -description: 'This search is to build a per user command and scripting risky SPL detection model using MLTK - DensityFunction algorithm based on audit log data of Splunk apps. The model is built from past 7 days users - history of running search commands from +description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, - and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of - outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that - boundary is smaller than 0.1% (three 9s - 0.999), indicating a risky use of these commands. Users can adjust - this threshold 0.1% to higher or lower value depending on desired false positive report rate. This search should - be scheduled to run at least as frequently as every 7 days. The name of machine learning model generated is + This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse + of interest during investigation and/or hunting. + The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model + uses the past 7 days of user history executing the above referenced commands then aggregates the total search + run time for each hour as indicator of user behavior. + The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can + adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search + should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection. ' -search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count +search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' + | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true + by Search_Activity.user into "risky_command_abuse" ' how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky - SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/ + SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 66251ae54c..e428e9ca9e 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -12,7 +12,7 @@ description: 'This detection utilizes machine learning model named "risky_comman https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)' -search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, +search: '| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) @@ -21,13 +21,14 @@ search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.tota AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse - | fields _time, user, searches, run_time, IsOutlier(run_time) + | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. + Please note that the current search only finds matches exactly one space between separator bar and risky commands. known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. references: @@ -49,7 +50,7 @@ tags: impact: 50 kill_chain_phases: - Actions on Objectives - message: Abnormally long run time for risk SPL command seen by user $user. + message: Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). mitre_attack_id: - T1059 nist: From d91d88ecb7f5a5fcd1b959c1178d469a401b1583 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 07:58:41 -0400 Subject: [PATCH 075/114] updated base on karims comments --- ...ng_interpreter_risky_spl_mltk_baseline.yml | 21 +++++++------------ 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index 9ebafeb336..4dfd0d8702 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -6,20 +6,13 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Baseline datamodel: - Splunk_Audit -description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, - This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse - of interest during investigation and/or hunting. - The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model - uses the past 7 days of user history executing the above referenced commands then aggregates the total search - run time for each hour as indicator of user behavior. - The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can - adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search - should be scheduled to run at least every 7 days. The name of machine learning model generated is - "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps - unless the same account of training this model will be used to perform inference using this model for anomaly - detection. ' +description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. +The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. +The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: +https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps +unless the same account of training this model will be used to perform inference using this model for anomaly +detection.' search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) From 786b26d85890cf5352503ed41c861fd4372106e1 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:04:57 -0400 Subject: [PATCH 076/114] fixing base on feedback from david --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 89545817db..6969eb15da 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type - | `drop_dm_object_name(Splunk_Audit)` + | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' From cbbe43658513aff764d3d07e95d554773434d7b6 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:07:14 -0400 Subject: [PATCH 077/114] updated given davids suggestions --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 6969eb15da..234673ce69 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -27,7 +27,7 @@ tags: - CIS 16 cve: - CVE-2022-32154 - confidence: 80 + confidence: 30 context: - Source:Endpoint dataset: @@ -57,6 +57,6 @@ tags: - Search_Activity.user - Search_Activity.savedsearch_name - Search_Activity.search_type - risk_score: 72 + risk_score: 27 security_domain: audit From 9e28d378cc7feb7c22d0cd64c0d93e358d484076 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:09:20 -0400 Subject: [PATCH 078/114] updated from karims suggestion --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 234673ce69..f6a130199f 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -35,7 +35,7 @@ tags: impact: 90 kill_chain_phases: - Actions on Objectives - message: Delete command has ran by $user$ and should be reviewed. + message: $user$ executed the 'delete' command, if this is unexpected it should be reviewed. mitre_attack_id: - T1059 nist: From b8d7a20e7391d4927b4ce3544d695b4cf9a8caa2 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:10:11 -0400 Subject: [PATCH 079/114] fixing dm to drop from davids suggestion --- .../splunk_command_and_scripting_interpreter_risky_commands.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 6444d94980..4511f8532c 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -13,7 +13,7 @@ description: 'The Splunk platform contains built-in search processing language ( In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type - | `drop_dm_object_name(Splunk_Audit)` + | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' From 4b95ac0339aec7bcdcbbba0e8c0a5bf99e129edc Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:15:36 -0400 Subject: [PATCH 080/114] Update splunk_digital_certificates_infrastructure_version.yml --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 3edd0e1940..01779041cc 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +description: This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: No known at this time. From 937a7317cfd80537295d1fce2c433b992f52b562 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:17:25 -0400 Subject: [PATCH 081/114] Update splunk_protocol_impersonation_weak_encryption_simplerequest.yml --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 2e29e2cbeb..6ff1261c1d 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' -description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +description: On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: From 35135877076e7528ad5159e4ff7bc56d76ba47a0 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:17:53 -0400 Subject: [PATCH 082/114] Update splunk_protocol_impersonation_weak_encryption_simplerequest.yml --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 6ff1261c1d..6b015586eb 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -31,7 +31,7 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Failed to validate certificate on host$ + message: Failed to validate certificate on $host$ mitre_attack_id: - T1588.004 nist: From 0288c10f70b931d7935233fcd6a9d9cdf6a8c5ea Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:18:53 -0400 Subject: [PATCH 083/114] Update splunk_identified_ssl_tls_certificates.yml --- detections/network/splunk_identified_ssl_tls_certificates.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index f5c2e8840e..2ad0783d72 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -5,7 +5,7 @@ date: '2022-05-25' author: Michael Haag, Splunk type: Hunting datamodel: [] -description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`' how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. From 9c3eb1640a677256045a946fb61ebeaaf1f51b9b Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 14 Jun 2022 09:17:24 -0400 Subject: [PATCH 084/114] fixing tscollect error --- ...ommand_and_scripting_interpreter_risky_spl_mltk_baseline.yml | 2 +- .../splunk_command_and_scripting_interpreter_risky_commands.yml | 2 +- .../splunk_command_and_scripting_interpreter_risky_spl_mltk.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index 4dfd0d8702..b9275b04d1 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -17,7 +17,7 @@ search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 4511f8532c..b1cadad85b 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -11,7 +11,7 @@ description: 'The Splunk platform contains built-in search processing language ( A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index e428e9ca9e..516c9f4af1 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -17,7 +17,7 @@ search: '| tstats sum(Search_Activity.total_run_time) AS run_time, FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse From 22de947482dd56fd765a0f8e4619bfe8c4ff4c94 Mon Sep 17 00:00:00 2001 From: research bot Date: Tue, 14 Jun 2022 14:10:53 +0000 Subject: [PATCH 085/114] updating docs and package bits [ci skip] --- dist/escu/app.manifest | 2 +- dist/escu/default/analyticstories.conf | 104 +++- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 48 +- dist/escu/default/savedsearches.conf | 450 +++++++++++++++++- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- docs/_data/navigation.yml | 2 + docs/_pages/detections.md | 10 + docs/_pages/splunk_audit.md | 9 + docs/_pages/stories.md | 2 +- ...od_without_successful_netbackup_backups.md | 2 +- ...17-09-12-unsuccessful_netbackup_backups.md | 2 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 2 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 2 +- ...detect_spike_in_security_group_activity.md | 2 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 2 +- ...-10-23-wmi_permanent_event_subscription.md | 2 +- ...-10-23-wmi_temporary_event_subscription.md | 2 +- .../2018-12-03-remote_wmi_command_attempt.md | 2 +- ...ikatz_via_powershell_and_eventcode_4703.md | 2 +- .../2019-04-25-suspicious_file_write.md | 2 +- ...9-10-11-prohibited_software_on_endpoint.md | 2 +- ...credential_dumping_through_lsass_access.md | 2 +- ...-03-detect_mimikatz_using_loaded_images.md | 2 +- ...6-access_lsass_memory_for_dump_creation.md | 2 +- ...9-12-06-create_remote_thread_into_lsass.md | 2 +- ...19-12-06-unsigned_image_loaded_by_lsass.md | 2 +- ...-03-creation_of_lsass_dump_with_taskmgr.md | 2 +- .../2020-03-16-detect_rare_executables.md | 2 +- ...0-first_time_seen_child_process_of_zoom.md | 2 +- .../2020-07-06-windows_event_log_cleared.md | 2 +- ...20-07-08-detect_new_local_admin_account.md | 2 +- ..._to_phishing_sites_leveraging_evilginx2.md | 10 +- ...web_traffic_to_dynamic_domain_providers.md | 2 +- ...ce_modified_with_previously_unseen_user.md | 2 +- ...first_time_seen_running_windows_service.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- ...ous_writes_to_system_volume_information.md | 2 +- ...20-07-22-uncommon_processes_on_endpoint.md | 2 +- ...ct_windows_dns_sigred_via_splunk_stream.md | 2 +- ...tivity_related_to_pass_the_hash_attacks.md | 2 +- ...2020-11-09-common_ransomware_extensions.md | 2 +- .../2020-11-09-common_ransomware_notes.md | 2 +- ..._system_network_configuration_discovery.md | 2 +- ...rohibited_applications_spawning_cmd_exe.md | 4 +- ...processes_run_from_unexpected_locations.md | 2 +- ...burst_correlation_dll_and_network_event.md | 2 +- ...cious_microsoft_workflow_compiler_usage.md | 2 +- ..._connecting_to_dynamic_domain_providers.md | 2 +- .../2021-01-20-suspicious_mshta_spawn.md | 2 +- ...ect_regsvr32_application_control_bypass.md | 2 +- ...cious_regsvr32_register_suspicious_path.md | 2 +- ...21-02-01-dump_lsass_via_procdump_rename.md | 2 +- ...21-03-12-ransomware_notes_bulk_creation.md | 2 +- ...3-16-high_process_termination_frequency.md | 2 +- ...16-windows_high_file_deletion_frequency.md | 2 +- ...3-17-clop_ransomware_known_service_name.md | 2 +- ...021-03-23-certutil_with_decode_argument.md | 2 +- ...021-03-31-disabling_firewall_with_netsh.md | 2 +- ...icious_powershell_executed_as_a_service.md | 2 +- ...heduled_task_created_within_public_path.md | 2 +- ...t_scheduled_task_created_to_spawn_shell.md | 2 +- ...-office_document_creating_schedule_task.md | 2 +- ...14-office_document_executing_macro_code.md | 2 +- ..._remote_thread_to_known_windows_process.md | 2 +- ...hedule_task_with_http_command_arguments.md | 2 +- ...dule_task_with_rundll32_command_trigger.md | 2 +- ...9-wermgr_process_create_executable_file.md | 2 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 2 +- ...-04-26-office_product_spawning_certutil.md | 2 +- ...021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 2 +- ...021-04-29-suspicious_driver_loaded_path.md | 2 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 2 +- ...21-05-04-process_kill_base_on_file_path.md | 2 +- ...021-05-06-download_files_using_telegram.md | 2 +- ...merate_users_local_group_using_telegram.md | 2 +- ...05-12-delete_shadowcopy_with_powershell.md | 2 +- ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 2 +- ...-allow_inbound_traffic_in_firewall_rule.md | 2 +- .../2021-05-19-mailsniper_invoke_functions.md | 2 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- .../2021-06-02-modification_of_wallpaper.md | 2 +- ...021-06-02-wbemprox_com_object_execution.md | 2 +- ...-04-known_services_killed_by_ransomware.md | 2 +- ...ss_process_injection_via_getprocaddress.md | 2 +- ..._script_contains_base64_encoded_content.md | 2 +- ...re_with_powershell_script_block_logging.md | 2 +- ...tz_with_powershell_script_block_logging.md | 2 +- ...021-06-09-unloading_amsi_via_reflection.md | 2 +- ...-06-10-powershell_creating_thread_mutex.md | 2 +- ...021-06-10-powershell_domain_enumeration.md | 2 +- ...ading_dotnet_into_memory_via_reflection.md | 2 +- ...10-powershell_processing_stream_of_data.md | 2 +- .../2021-06-10-recon_using_wmi_class.md | 2 +- ...4-wmi_recon_running_process_or_services.md | 2 +- ...tect_wmi_event_subscription_persistence.md | 2 +- ...7-suspicious_event_log_service_behavior.md | 2 +- ...-powershell_enable_smb1protocol_feature.md | 2 +- ...ursive_delete_of_directory_in_batch_cmd.md | 2 +- ...w_file_and_printing_sharing_in_firewall.md | 2 +- ...-23-allow_network_discovery_in_firewall.md | 2 +- ...4-excessive_usage_of_sc_service_utility.md | 2 +- ...07-01-spoolsv_suspicious_loaded_modules.md | 6 +- ...07-01-spoolsv_suspicious_process_access.md | 2 +- ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md | 2 +- ...-07-12-uac_bypass_mmc_load_unsigned_dll.md | 2 +- ...a_spawning_rundll32_or_regsvr32_process.md | 2 +- ...-07-19-office_product_spawn_cmd_process.md | 2 +- ...of_shadowcopy_with_script_block_logging.md | 2 +- ...-rundll32_createremotethread_in_browser.md | 2 +- ...rundll32_process_creating_exe_dll_files.md | 2 +- ...gsvr32_with_known_silent_switch_cmdline.md | 2 +- ...dll32_create_remote_thread_to_a_process.md | 2 +- .../2021-07-30-drop_icedid_license_dat.md | 2 +- ...edid_exfiltrated_archived_file_creation.md | 2 +- ...fice_application_spawn_regsvr32_process.md | 2 +- ...2021-08-03-sqlite_module_in_temp_folder.md | 2 +- ...eate_remote_thread_in_shell_application.md | 2 +- ...8-13-uac_bypass_with_colorui_com_object.md | 2 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 2 +- ...9-aws_ecr_container_upload_unknown_user.md | 2 +- ...1-08-20-github_commit_changes_in_master.md | 2 +- ...2021-08-20-kubernetes_nginx_ingress_lfi.md | 2 +- ...er_account_with_powershell_script_block.md | 2 +- ...2021-08-23-kubernetes_nginx_ingress_rfi.md | 2 +- ...21-08-24-adsisearcher_account_discovery.md | 2 +- ...omaintrust_with_powershell_script_block.md | 2 +- ...get_aduser_with_powershell_script_block.md | 2 +- ...ct_ds_user_with_powershell_script_block.md | 2 +- ...omain_group_discovery_with_adsisearcher.md | 2 +- ...elevated_group_discovery_with_powerview.md | 2 +- ...t_ds_group_with_powershell_script_block.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...mainpolicy_with_powershell_script_block.md | 2 +- ...omaingroup_with_powershell_script_block.md | 2 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 2 +- ...-08-27-exchange_powershell_module_usage.md | 2 +- ...petitpotam_network_share_access_request.md | 2 +- ...itpotam_suspicious_kerberos_tgt_request.md | 2 +- ...adcomputer_with_powershell_script_block.md | 2 +- ...s_computer_with_powershell_script_block.md | 2 +- .../2021-09-01-github_commit_in_develop.md | 2 +- .../2021-09-01-github_dependabot_alert.md | 2 +- ...1-github_pull_request_from_unknown_user.md | 2 +- ...mote_system_discovery_with_adsisearcher.md | 2 +- ...oresttrust_with_powershell_script_block.md | 2 +- ...incomputer_with_powershell_script_block.md | 2 +- ...controller_with_powershell_script_block.md | 2 +- ...e_by_app_connect_and_create_adsi_object.md | 2 +- ...2021-09-09-extraction_of_registry_hives.md | 2 +- ...connection_with_powershell_script_block.md | 2 +- ...s_scripting_process_loading_ldap_module.md | 2 +- ...ms_scripting_process_loading_wmi_module.md | 2 +- ...21-09-13-xsl_script_execution_with_wmic.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- ...me_process_accessing_chrome_default_dir.md | 2 +- ...efox_process_access_firefox_profile_dir.md | 2 +- ...t_to_add_certificate_to_untrusted_store.md | 2 +- ...edential_dump_from_registry_via_reg_exe.md | 4 +- ...of_shadow_copy_with_wmic_and_powershell.md | 2 +- ...mping_via_copy_command_from_shadow_copy.md | 2 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 2 +- ...16-detect_html_help_url_in_command_line.md | 2 +- ...ml_help_using_infotech_storage_handlers.md | 2 +- ...09-16-detect_mshta_inline_hta_execution.md | 2 +- ...-09-16-detect_mshta_url_in_command_line.md | 2 +- ...9-16-detect_psexec_with_accepteula_flag.md | 2 +- .../2021-09-16-dump_lsass_via_procdump.md | 2 +- ...09-16-local_account_discovery_with_wmic.md | 2 +- ...2021-09-16-office_product_spawning_wmic.md | 2 +- .../2021-09-16-processes_launching_netsh.md | 2 +- .../2021-09-29-verclsid_clsid_execution.md | 2 +- ...32_silent_and_install_param_dll_loading.md | 2 +- ...rincipalnames_discovery_with_powershell.md | 2 +- ...iceprincipalnames_discovery_with_setspn.md | 2 +- ...ows_task_scheduler_event_action_started.md | 2 +- .../2021-11-11-wmic_xsl_execution_via_url.md | 2 +- ...21-11-12-csc_net_on_the_fly_compilation.md | 2 +- ...twork_discovery_using_route_windows_app.md | 2 +- ...12-remote_process_instantiation_via_wmi.md | 2 +- ...21-11-12-runas_execution_in_commandline.md | 2 +- ...12-windows_installutil_uninstall_option.md | 2 +- ...windows_installutil_url_in_command_line.md | 2 +- ...ion_via_wmi_and_powershell_script_block.md | 2 +- ...ile_written_in_administrative_smb_share.md | 2 +- .../2021-11-18-loading_of_dynwrapx_module.md | 2 +- ...info_gathering_using_dxdiag_application.md | 2 +- ...ce_created_with_suspicious_service_path.md | 2 +- ...dows_service_created_within_public_path.md | 2 +- ...ell_windows_defender_exclusion_commands.md | 2 +- ...-11-29-detect_rclone_command-line_usage.md | 2 +- ...-msi_module_loaded_by_non-system_binary.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 2 +- ..._hunting_system_account_targeting_lsass.md | 2 +- ...dows_non-system_account_targeting_lsass.md | 2 +- ...-cmd_carry_out_string_command_parameter.md | 2 +- ...shell_remove_windows_defender_directory.md | 2 +- ...cess_dns_query_known_abuse_web_services.md | 2 +- ...dows_dotnet_binary_in_non_standard_path.md | 2 +- ...indows_installutil_in_non_standard_path.md | 2 +- ...ive_file_deletion_in_windefender_folder.md | 2 +- .../2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-24-windows_nirsoft_utilities.md | 2 +- ...-27-windows_possible_credential_dumping.md | 2 +- ...nload_with_urlcache_and_split_arguments.md | 2 +- ...load_with_verifyctl_and_split_arguments.md | 2 +- ..._ticket_exports_through_winlogon_access.md | 2 +- ...7-windows_schtasks_create_run_as_system.md | 2 +- ...oasting_spn_request_with_rc4_encryption.md | 2 +- ...2-15-windows_diskshadow_proxy_execution.md | 2 +- ..._raw_access_to_master_boot_record_drive.md | 2 +- ...8-detect_regasm_with_network_connection.md | 2 +- ...-detect_regsvcs_with_network_connection.md | 2 +- ...authentication_discovery_with_powerview.md | 2 +- ...-process_deleting_its_process_file_path.md | 2 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 2 +- ...uthentication_discovery_with_get-aduser.md | 2 +- ...2-02-22-windows_wmi_process_call_create.md | 2 +- ...ndows_excessive_disabled_services_event.md | 2 +- ...ows_raw_access_to_disk_volume_partition.md | 2 +- docs/_posts/2022-03-04-macos_lolbin.md | 2 +- ...t_regasm_with_no_command_line_arguments.md | 2 +- ..._regsvcs_with_no_command_line_arguments.md | 2 +- ...ice_ticket_request_using_rc4_encryption.md | 2 +- ...cious_dllhost_no_command_line_arguments.md | 2 +- ...ious_gpupdate_no_command_line_arguments.md | 2 +- ...s_installutil_remote_network_connection.md | 2 +- ...stallutil_uninstall_option_with_network.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...domainuser_with_powershell_script_block.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- ...getadgroup_with_powershell_script_block.md | 2 +- ...rrent_user_with_powershell_script_block.md | 2 +- ...tlocaluser_with_powershell_script_block.md | 2 +- ...sion_on_remote_endpoint_with_powershell.md | 2 +- ...ntication_flag_disabled_with_powershell.md | 2 +- ...022-03-22-powershell_execute_com_object.md | 2 +- ...owershell_using_memory_as_backing_store.md | 2 +- ...3-22-recon_avproduct_through_pwh_or_wmi.md | 2 +- ...on_via_dcom_and_powershell_script_block.md | 2 +- ...n_via_winrm_and_powershell_script_block.md | 2 +- ...y_with_env_vars_powershell_script_block.md | 2 +- ...uter_unconstrained_delegation_discovery.md | 2 +- ...view_unconstrained_delegation_discovery.md | 2 +- ...03-28-windows_terminating_lsass_process.md | 2 +- ...-30-windows_drivers_loaded_by_signature.md | 2 +- ...erview_constrained_delegation_discovery.md | 2 +- ...ithub_actions_disable_security_workflow.md | 2 +- ...4-windows_driver_load_non-standard_path.md | 2 +- ...4-04-windows_event_for_service_disabled.md | 2 +- ...022-04-18-nltest_domain_trust_discovery.md | 2 +- ...rocesses_killed_by_industroyer2_malware.md | 2 +- ...ndows_linked_policies_in_adsi_discovery.md | 2 +- ...s_root_domain_linked_policies_discovery.md | 2 +- ...6-windows_hidden_schedule_task_settings.md | 2 +- ...ter_account_created_by_computer_account.md | 2 +- ...uter_account_requesting_kerberos_ticket.md | 2 +- ...windows_kerberos_local_successful_logon.md | 2 +- ...04-28-windows_computer_account_with_spn.md | 2 +- ...-02-windows_krbrelayup_service_creation.md | 2 +- .../2022-05-16-cobalt_strike_named_pipes.md | 2 +- ...nd_scripting_interpreter_risky_commands.md | 181 +++++++ ...rsonation_weak_encryption_simplerequest.md | 162 +++++++ ...-splunk_identified_ssl_tls_certificates.md | 166 +++++++ ...rsonation_weak_encryption_configuration.md | 167 +++++++ docs/_posts/2022-05-26-macos_plutil.md | 2 +- ...tal_certificates_infrastructure_version.md | 165 +++++++ ...digital_certificates_lack_of_encryption.md | 165 +++++++ ...ss_injection_forwarder_bundle_downloads.md | 166 +++++++ ...mpersonation_weak_encryption_selfsigned.md | 162 +++++++ ..._and_scripting_interpreter_delete_usage.md | 170 +++++++ ...nd_scripting_interpreter_risky_spl_mltk.md | 176 +++++++ ...01-mshtml_module_load_in_office_product.md | 170 +++++++ ...spicious_process_with_discord_dns_query.md | 170 +++++++ ...ess_connecting_to_ip_check_web_services.md | 165 +++++++ ...01-windows_installutil_credential_theft.md | 171 +++++++ ...2-06-03-excessive_usage_of_nslookup_app.md | 2 +- docs/_stories/splunk_vulnerabilities.md | 13 +- docs/mitre-map/coverage.json | 40 +- 284 files changed, 3274 insertions(+), 300 deletions(-) create mode 100644 docs/_pages/splunk_audit.md create mode 100644 docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md create mode 100644 docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md create mode 100644 docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md create mode 100644 docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md create mode 100644 docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md create mode 100644 docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md create mode 100644 docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md create mode 100644 docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md create mode 100644 docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md create mode 100644 docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md create mode 100644 docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md create mode 100644 docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md create mode 100644 docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md create mode 100644 docs/_posts/2022-06-01-windows_installutil_credential_theft.md diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 731920e356..beca1e0b1d 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.42.0" + "version": "3.43.0" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index dba4e07934..20055617d0 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -17,6 +17,56 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = This search may find additional path traversal exploitation attempts. providing_technologies = [] +[savedsearch://ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. +how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +known_false_positives = False positives will be present until properly filtered by Username and search name. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) +how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. +annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]} +known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Digital Certificates Infrastructure Version - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +known_false_positives = No known at this time. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Digital Certificates Lack of Encryption - Rule] +type = detection +asset_type = endpoint +confidence = medium +explanation = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +known_false_positives = None at this time +providing_technologies = [] + [savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule] type = detection asset_type = Endpoint @@ -27,6 +77,46 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = None. providing_technologies = [] +[savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]} +known_false_positives = None at this time. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]} +known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +providing_technologies = [] + +[savedsearch://ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +providing_technologies = [] + +[savedsearch://ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +providing_technologies = [] + [savedsearch://ESCU - Splunk User Enumeration Attempt - Rule] type = detection asset_type = endpoint @@ -9099,6 +9189,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.00 known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Splunk Identified SSL TLS Certificates - Rule] +type = detection +asset_type = Proxy +confidence = medium +explanation = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]} +known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized. +providing_technologies = [] + [savedsearch://ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule] type = detection asset_type = Web Server @@ -10487,7 +10587,7 @@ version = 1 references = ["https://www.splunk.com/en_us/product-security/announcements.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}] spec_version = 3 -searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule"] +searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"] description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index f3e75d5dc0..9e5df9e53a 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 8166 +build = 8305 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.42.0 +version = 3.43.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 6385ce639b..57d68c71fa 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 305cdc9464..0be9e35fe9 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.42.0 +version = 3.43.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index b38bf7c285..3c88f0a809 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 330a659e90..b63225caef 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -9,10 +9,46 @@ definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_command_and_scripting_interpreter_delete_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_command_and_scripting_interpreter_risky_commands_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_command_and_scripting_interpreter_risky_spl_mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_digital_certificates_infrastructure_version_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_digital_certificates_lack_of_encryption_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [splunk_dos_via_malformed_s2s_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_process_injection_forwarder_bundle_downloads_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_protocol_impersonation_weak_encryption_configuration_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_protocol_impersonation_weak_encryption_selfsigned_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_protocol_impersonation_weak_encryption_simplerequest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [splunk_user_enumeration_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3545,6 +3581,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_identified_ssl_tls_certificates_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3863,7 +3903,7 @@ definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new provisioning activities [printservice] -definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +definition = source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [process_bitsadmin] @@ -4071,6 +4111,10 @@ description = This macro is a list of AWS event names associated with security g definition = index=signals description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[splunk_python] +definition = index=_internal sourcetype=splunk_python +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [splunkd] definition = index=_internal sourcetype=splunkd description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 806359d4a1..68584dab81 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -52,6 +52,206 @@ realtime_schedule = 0 is_visible = false search = `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by status clientip method uri_path uri_query | `path_traversal_spl_injection_filter` +[ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +action.escu.data_models = ["Splunk_Audit"] +action.escu.eli5 = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +action.escu.how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +action.escu.known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed. +action.escu.creation_date = 2022-05-27 +action.escu.modification_date = 2022-05-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $user$ executed the 'delete' command, if this is unexpected it should be reviewed. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter` + +[ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +action.escu.data_models = ["Splunk_Audit"] +action.escu.eli5 = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. +action.escu.how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = False positives will be present until properly filtered by Username and search name. +action.escu.creation_date = 2022-05-23 +action.escu.modification_date = 2022-05-23 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = A risky Splunk command has ran by $user$ and should be reviewed. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter` + +[ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) +action.escu.mappings = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]} +action.escu.data_models = ["Splunk_Audit"] +action.escu.eli5 = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) +action.escu.how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. +action.escu.known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +action.escu.creation_date = 2022-05-27 +action.escu.modification_date = 2022-05-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 6"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter` + +[ESCU - Splunk Digital Certificates Infrastructure Version - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = No known at this time. +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Digital Certificates Infrastructure Version - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates +action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Digital Certificates Infrastructure Version - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32153"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter` + +[ESCU - Splunk Digital Certificates Lack of Encryption - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +action.escu.how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = None at this time +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Digital Certificates Lack of Encryption - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $hostname$ is not using TLS when forwarding data +action.risk.param._risk = [{"risk_object_field": "hostname", "risk_object_type": "system", "risk_score": 20}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Digital Certificates Lack of Encryption - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32151"], "impact": 25, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"], "observable": [{"name": "hostname", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter` + [ESCU - Splunk DoS via Malformed S2S Request - Rule] action.escu = 0 action.escu.enabled = 1 @@ -98,6 +298,166 @@ realtime_schedule = 0 is_visible = false search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter` +[ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +action.escu.how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = None at this time. +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilites"] +action.risk = 1 +action.risk.param._risk_message = $peer$ downloaded apps from $host$ +action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilites"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32157", "CVE-2022-32158"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter` + +[ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +action.escu.creation_date = 2022-05-25 +action.escu.modification_date = 2022-05-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates +action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32151"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter` + +[ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +action.escu.how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Splunk default issued certificate at $host$ +action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter` + +[ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +action.escu.how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +action.escu.creation_date = 2022-05-24 +action.escu.modification_date = 2022-05-24 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Failed to validate certificate on $host$ +action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter` + [ESCU - Splunk User Enumeration Attempt - Rule] action.escu = 0 action.escu.enabled = 1 @@ -20635,8 +20995,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = Limited false positives will be present, however, tune as necessary. -action.escu.creation_date = 2021-09-09 -action.escu.modification_date = 2021-09-09 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - MSHTML Module Load in Office Product - Rule action.escu.search_type = detection @@ -20670,7 +21030,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter` +search = `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter` [ESCU - MSI Module Loaded by Non-System Binary - Rule] action.escu = 0 @@ -27245,7 +27605,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter` +search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter` [ESCU - Spoolsv Suspicious Process Access - Rule] action.escu = 0 @@ -28305,8 +28665,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. action.escu.how_to_implement = his detection relies on sysmon logs with the Event ID 22, DNS Query. action.escu.known_false_positives = Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. -action.escu.creation_date = 2022-01-19 -action.escu.modification_date = 2022-01-19 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious Process With Discord DNS Query - Rule action.escu.search_type = detection @@ -28334,7 +28694,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer process_path | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter` +search = `sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter` [ESCU - Suspicious Reg exe Process - Rule] action.escu = 0 @@ -29961,8 +30321,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule action.escu.search_type = detection @@ -29996,7 +30356,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` +search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` [ESCU - Wermgr Process Create Executable File - Rule] action.escu = 0 @@ -31787,8 +32147,8 @@ If used by a developer, typically this will be found with multiple command-line During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed. -action.escu.creation_date = 2021-11-12 -action.escu.modification_date = 2021-11-12 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Windows InstallUtil Credential Theft - Rule action.escu.search_type = detection @@ -31825,7 +32185,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter` +search = `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter` [ESCU - Windows InstallUtil in Non Standard Path - Rule] action.escu = 0 @@ -39256,6 +39616,46 @@ realtime_schedule = 0 is_visible = false search = `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter` +[ESCU - Splunk Identified SSL TLS Certificates - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +action.escu.how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized. +action.escu.creation_date = 2022-05-25 +action.escu.modification_date = 2022-05-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Identified SSL TLS Certificates - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = The following $dest$ is using the self signed Splunk certificate. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Identified SSL TLS Certificates - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Application Log"], "cve": ["CVE-2022-32151", "CVE-2022-32152"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter` + [ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule] action.escu = 0 action.escu.enabled = 1 @@ -40954,6 +41354,28 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process +[ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline +description = This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection. +action.escu.creation_date = 2022-05-27 +action.escu.modification_date = 2022-05-27 +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.escu.data_models = ["Splunk_Audit"] +cron_schedule = 0 * * * * +enableSched = 1 +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection. +action.escu.how_to_implement = The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment. +disabled = true +is_visible = false +search = | tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true by Search_Activity.user into "risky_command_abuse" + [ESCU - Systems Ready for Spectre-Meltdown Windows Patch] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index ead268f0d4..0d34ae2dc9 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 9ef141aaa8..6e310d4fdc 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 386f85e71a..6c3f138879 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -60,6 +60,8 @@ detections: url: /detections/network_traffic/ - title: Risk url: /detections/risk/ + - title: Splunk_Audit + url: /detections/splunk_audit/ - title: UEBA url: /detections/ueba/ - title: Updates diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index e35b0f6062..e72b9fbb63 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -692,10 +692,20 @@ sidebar: | [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spectre and Meltdown Vulnerable Systems](/deprecated/spectre_and_meltdown_vulnerable_systems/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spike in File Writes](/endpoint/spike_in_file_writes/) | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Command and Scripting Interpreter Risky SPL MLTK](/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Identified SSL TLS Certificates](/network/splunk_identified_ssl_tls_certificates/) | [Network Sniffing](/tags/#network-sniffing) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Process Injection Forwarder Bundle Downloads](/application/splunk_process_injection_forwarder_bundle_downloads/) | [Process Injection](/tags/#process-injection) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/splunk_audit.md b/docs/_pages/splunk_audit.md new file mode 100644 index 0000000000..7613bed97f --- /dev/null +++ b/docs/_pages/splunk_audit.md @@ -0,0 +1,9 @@ +--- +title: Splunk_Audit +layout: tag +author_profile: false +taxonomy: Splunk_Audit +permalink: /detections/splunk_audit/ +sidebar: + nav: "detections" +--- \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 9d241a8a92..18efa21234 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -109,7 +109,7 @@ sidebar: | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None | -| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Network Denial of Service](/tags/#network-denial-of-service), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index d485eb70b4..64449b47a3 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) > :information_source: > **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index 31a66e2bfa..14cc93f2cc 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) > :information_source: > **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 351df8d65f..5860da8991 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,8 +95,8 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index e9ed6c984d..051f22e654 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -100,8 +100,8 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index ba87d130b6..bbb21c3187 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) > :information_source: > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 473271fdc1..f4a348e37c 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) > :information_source: > **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 7ddc9ec68b..5604b56488 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) > :information_source: > **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 02ca8ce578..71d6f444e4 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) > :information_source: > **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index e330d0107c..7f77a75359 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -110,8 +110,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index dae186beec..47ee78a2f2 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index d7830d2ff0..aed242ad09 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -99,8 +99,8 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: -* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 661feb67e5..87c524140d 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -103,8 +103,8 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 875ff5b43e..be75b3546b 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 445b0aa8ec..3de046b373 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 6228d32f4a..ade57132a5 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index 01a8bca88b..be36a668be 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index 6ce1a2e91d..f7818c9cf6 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index e89e183dd1..d877cebd94 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 49ce545359..7b015eb774 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -114,8 +114,8 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 4a05b41d21..1164dc80d2 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -114,8 +114,8 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 610808a839..3f3ed50d37 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,9 +115,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index b14f43e277..3e6512d9d8 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index 540303dc4e..c51c767f06 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index da4c4419a2..9a0b7389ef 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -109,8 +109,8 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index a3f8704de8..7706e0d302 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,8 +118,8 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 3f454963e2..97977c0cfd 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index a9d2a15203..7032505da1 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -117,8 +117,8 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: -* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 9b0f587725..2ba8eb08fa 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 11e77acc60..d5664f0705 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -108,8 +108,8 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 906d51e1ca..ed73e8c274 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) +* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) > :information_source: > **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index d7016c612e..8afe9011b3 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index dc37dca253..5ef412da61 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -110,8 +110,8 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index 315432c79b..02e4d5a45d 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -109,8 +109,8 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index f3728f515c..c0b41eca2c 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -113,8 +113,8 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: -* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index d2ce551ed0..5e95657880 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,9 +113,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 617e428b64..4ae024d1ea 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -116,8 +116,8 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index fd49f87ac7..7e4aa6a628 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 56ad8afeab..a9eda9f12e 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -108,8 +108,8 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index f3ff99120f..acb9fc9e9c 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -113,8 +113,8 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index c1aa23acd7..7c5c6ff72c 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -112,8 +112,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index bf8e91a006..6c37af2788 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -113,8 +113,8 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index 67902820ae..f9cf1a3efd 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -112,8 +112,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index f790f144d3..beea6f235b 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 18070e75e0..620ce0a918 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index d4cf37746f..db41bf7dfa 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index b73da35928..5ac8414b89 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 0b7fdfe081..20649a78c8 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index af163128da..b7495a6ba1 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -102,8 +102,8 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index f0359f53c9..9484c6a320 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -107,8 +107,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index ab261f4d7d..ebd16db17c 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index 8298ca7fc7..6809b34a14 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 5ff4bdb821..fa288d86e1 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index bef8758516..56c059af2a 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index eeb3ab4fee..d2d52c4271 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 000c69e486..85a2c57319 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index b297562c89..3518e5e547 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 80da349bf8..323536440f 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index caf4fa1b8e..a3a7e05749 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index cd8bc91dff..1d6f90aadf 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index 68372ed7a1..aee81a0e17 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 5fda55ea06..23dc5d2084 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index cc29fc4eab..895a6c51d5 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index ff1e142ac3..43c3a38d63 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 7046351428..aea92238c8 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 2991a72568..7832bc24d5 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -107,8 +107,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 43eaa37a0b..e75d99cd23 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index 2283e7d33e..04879af5f4 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -101,8 +101,8 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index cdb6bd5506..b1bcc55565 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -101,8 +101,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 64ff8b9995..869bea7299 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index f8d18f858e..9f0639ec6f 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -106,8 +106,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index e5e1267fc9..4ea231a206 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -106,8 +106,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index c32f863108..09d1324b0b 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,8 +119,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index bb4baa84c7..5286c0105c 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index aa6d560171..f095875738 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index 3c01acc3b9..e87879902a 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 98ba72fb42..9ee956342a 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -114,8 +114,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index c538fe2b26..0dd71e0692 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -113,8 +113,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index fa15056f8b..937137c5c5 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index b7dc1c284f..9cdd30b4b4 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index 793f8550d3..6951933b36 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 6c6cf0c524..3d95cf36ad 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index ddf93250e3..0757c652df 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index 22736ee8b4..667a553d34 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 4653bf74ad..b71eb3e434 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 4c8d730be6..d8de0164f3 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 35dc4c2b53..6e8073b494 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index 72713207b3..d2bde70c61 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index f638d3f37f..ff2ea0cea2 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -115,8 +115,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 85426be232..937bb94c5e 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -106,8 +106,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index eb65981ea1..18aeadf0f2 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,8 +107,8 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index bfc3e0d66e..8c3d97cd67 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -107,8 +107,8 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index f6419290a6..901c9a4e51 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -107,8 +107,8 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 849bccd29b..f3fa23324d 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index cb2ac3bed0..c3db511f1e 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -105,7 +105,7 @@ This search is to detect suspicious loading of dll in specific path relative to ``` `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" -| stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode +| stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -165,4 +165,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index a22067412c..406084fcfc 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 72cefff943..20678262d5 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index c9f070f3ec..6f9d39c5bf 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 6897b647f6..251e2c5e25 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -107,9 +107,9 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 1a8abd0c7d..2d76b31dca 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,8 +107,8 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index 1f08a24b4d..ba50bfd6fb 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index 7ee60a9e83..ef3e261bdf 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 2fee621286..2612bc03e8 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index 27cbb5c585..a70a85e8c3 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -109,8 +109,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index fdf4ec8c06..57dd88fc58 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 35acb6bef9..229fecc735 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 7ee2b55ee4..1f2de9c0c4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index ae7b48391d..d478b8a1dc 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index e3ec1efb85..24da952f26 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index bf0db94672..2d8501f31d 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 65a9387f53..3fb4417f2a 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 0be02ff4ba..fcb09a3843 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -108,8 +108,8 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 5a3ba78959..c53734cb79 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index b176886222..0db42eec42 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index ac0fc91be6..d467a3d42a 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) > :information_source: > **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 6a544a3ab2..5154dc678b 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index ab149bc49c..d62060e513 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) > :information_source: > **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index ea9a9b6194..5f2ea3159e 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 05ece5ca7d..73f076029d 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index 2885ec9bca..983227c015 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index c090f4f54a..85d80cf3e0 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 56e7aa0105..1d73972dff 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index 95bcfb93d3..98c721908f 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 52ea5b8660..1459f1acb7 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index ff79a04102..3d7f3879c5 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index ee64ac4113..f458409ba1 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index 545ab393fc..7b0607e962 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index a4109f88e7..27495bc909 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) > :information_source: > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 38f8098ad8..4ed53fb857 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -111,8 +111,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 74fd24e098..7ae0dd38c1 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -108,8 +108,8 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 097e4595bc..639b6ff4aa 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -105,8 +105,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 9f6011c46d..b9e7f01b8a 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 9ef16fa75a..9170f1ee06 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 2eef99dca3..e2886e38e9 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index fd2a212384..8e071247fe 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs. #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 986599f6e5..2d64e0e59c 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index f62c1c6ce5..4f4365757b 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index 6004b1416c..daeb19634d 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index f35dfdad93..e820fccf06 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 6438259673..97f3ed9faf 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 5f1e7fe3f7..64cb7c7e3c 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index de39548248..906af392f7 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -107,8 +107,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 9cbc7d7180..0d5361e0f4 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 3b0d396361..397b2fde50 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index d0dc7976de..9b34319ea7 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index d16a8f74c7..34a46ae1ab 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -102,8 +102,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 96189c8f79..406541d7d5 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index 9f48a1bb5b..d8ee054155 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index eb47910925..a2d1d3b7c1 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 1ce1a64c89..54672494fe 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -116,8 +116,8 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 8ee59db57a..9aa29771a0 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,9 +113,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index d5cdc78b58..d5760a955e 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,8 +112,8 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index dcf5dcfcc6..6b569688ce 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,8 +112,8 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 07f3c1ee10..21b44df3dd 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,8 +112,8 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 2b0c206d92..2301b8a300 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 7adebd9f38..879ffee11e 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index eacfc71a0e..917308ab5f 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -112,8 +112,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 6e43b419ee..6d3b9fd3f3 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -112,8 +112,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 1dea81ca3d..792de3fc4f 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -112,8 +112,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index cbd7f74e6d..1a41c5629e 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,8 +114,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 8bbbca5fdd..df514a0d38 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 11ee174959..82fd721322 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 25121ac6e9..0969ffa570 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -112,8 +112,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 5ed0df7318..81c53e695d 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,8 +107,8 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 9014907709..9a0aea5cea 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -109,8 +109,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index c6a43b9ce7..1d8f99d51b 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -104,8 +104,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 14fed43740..7a1f5eedc5 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -109,8 +109,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index 8b58d45823..d893b1bbd3 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -104,8 +104,8 @@ The following hunting analytic assists with identifying suspicious tasks that ha #### Macros The SPL above uses the following Macros: -* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) > :information_source: > **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 284af4d9fc..83bfac410c 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -102,8 +102,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index e393521d7a..52abb47d1e 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -107,8 +107,8 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index dfdeda3039..1f87ace6f7 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -107,8 +107,8 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: -* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 622f31b0c1..41a3561c9d 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -110,8 +110,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index 44ab86c0bc..8a8ef5efad 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -109,8 +109,8 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: -* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 55bc046bbd..215c786252 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index c2736e0ce1..dfc676e66c 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index b8856a3372..7b124d8434 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 61fc5ef9a0..04a37eba8b 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -105,8 +105,8 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index ab844da06b..1c834b88c8 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index f2e189df34..8a5c2e0826 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -103,8 +103,8 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index 44e6b12703..b547469c0b 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 1c40def6e4..ddf621fad7 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index 6c2914b698..9d367f82a9 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -106,8 +106,8 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index bb1802f83a..625fff80eb 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -103,8 +103,8 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index d94c2cff62..180db1a279 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 5d26459021..9c3749457a 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -107,8 +107,8 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 58ff38a98a..ee9b513261 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index c48ad067c4..cc2eb7766c 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 65de741ab3..b0cb5436ae 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,8 +112,8 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index 79d72396a3..a5c900d7f4 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -112,8 +112,8 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index b4a40a14d5..02fb93e350 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 1ce9a54f4f..d77807e154 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -118,8 +118,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: -* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 14da8b3f81..58e4d0e11d 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,8 +117,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index f0282edf5f..837ffae589 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index 24d910afbf..cc3548f17a 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -115,8 +115,8 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: -* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index 5a80b1df2e..c8dcd7fcfc 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -103,8 +103,8 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index e89c702ca3..7799ba7e41 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index 5baa3b5d90..d092e269dc 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -102,8 +102,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index 12ab6d2b16..b4a4ddd812 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -102,8 +102,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index df18dc6ceb..7e85cb86f9 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 7722585244..be25d49dfa 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -111,8 +111,8 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: -* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index 50528a4b61..8ebe56389a 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -110,8 +110,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 1ca1eaee9e..4417a3dfb8 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -106,8 +106,8 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: -* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index 39f2b80d72..12bd46fc7a 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 51d1e73d56..b8e76acd2d 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 663285a202..6c6367c37c 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index 3c247d1e0f..22d141bf26 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index fe11db54f8..d2e44a1965 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index 75b9319c65..d2f3c5bda6 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 2b99704f67..60219a7987 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 96eedbf53b..65ca269f9e 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -108,8 +108,8 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 0fa7e197b5..46b18ec802 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 8585a4f9e0..539abbfa7f 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index 2d6f2c8949..94c82a2200 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -115,8 +115,8 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p #### Macros The SPL above uses the following Macros: -* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) > :information_source: > **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index da8370397f..166aa0dead 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: -* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index a4972826ff..2a33a397b7 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md index 54d27c0615..2b4295dc4f 100644 --- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md @@ -105,8 +105,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index c5fb8b3ffa..e9b550679a 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -105,8 +105,8 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index 844a893453..f1df36b2c2 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,8 +104,8 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index f012129af1..a695f6e7b7 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,8 +115,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 5204d6ee21..e7ffbdeb55 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index 74f5f965b3..b92d9ede9a 100644 --- a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md index da5c5a0d7a..6537929b66 100644 --- a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md index 3b0d03259d..bc2cd769f7 100644 --- a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md index d41c63b039..2f98054adc 100644 --- a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md index 7360d8b806..a17ba7e26e 100644 --- a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md index fce94f7e8c..852b9be36e 100644 --- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md index 794c52a432..6b739035e2 100644 --- a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md index 1dbda3af81..ae8a733c0f 100644 --- a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md index 18ed9ef03a..812e504e80 100644 --- a/docs/_posts/2022-03-22-powershell_execute_com_object.md +++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md @@ -108,8 +108,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md index 86b61d0868..f1e1f53671 100644 --- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md index 41ca8c1dbb..4b2f95e35b 100644 --- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 669000fd6a..d1a7fe8c0b 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md index e285770d5e..b98a1b1544 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md index c4cca2d7ac..b3eca55344 100644 --- a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md index 5b961d19a5..a3aedd0f60 100644 --- a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md index 3864819c70..bf1b12c71f 100644 --- a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 424eff1d3a..42ee8d7ce7 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index f5be1cf051..c503983391 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md index 7273292702..55aa0881cd 100644 --- a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md +++ b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index 008e97ef0a..cb85c01f90 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index a49622fd78..e8bf097fdc 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -107,8 +107,8 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index ba8933f81a..5d7224b035 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 3ca6c97894..7192ee4b40 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -107,8 +107,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index b10e220124..7249744d4d 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md index 34af68501f..70fa0e4f3f 100644 --- a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md +++ b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md index db7c76d204..dc17c69bb6 100644 --- a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md +++ b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md index 78de749e75..41c9d503c8 100644 --- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md +++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md @@ -111,8 +111,8 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md index 2c0de92432..0716084d03 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md +++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md @@ -107,8 +107,8 @@ The following analytic identifes a Computer Account creating a new Computer Acco #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md index b5599f262c..6508556aaa 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md +++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md @@ -107,8 +107,8 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md index 8801b6f266..3d6baf3523 100644 --- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md +++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md @@ -107,8 +107,8 @@ The following analytic identifies a local successful authentication event on a W #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md index 82539a9f8d..7c459b8206 100644 --- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md +++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md @@ -109,8 +109,8 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 50bd382f02..197ec18a1a 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index 484b31b7fd..562a6beea7 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md new file mode 100644 index 0000000000..a4e1df1b24 --- /dev/null +++ b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md @@ -0,0 +1,181 @@ +--- +title: "Splunk Command and Scripting Interpreter Risky Commands" +excerpt: "Command and Scripting Interpreter +" +categories: + - Application +last_modified_at: 2022-05-23 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Splunk_Audit +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) +- **Last Updated**: 2022-05-23 +- **Author**: Michael Haag, Splunk +- **ID**: 1cf58ae1-9177-40b8-a26c-8966040f11ae + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("* +| runshellscript *", "* +| collect *","* +| delete *", "* +| fit *", "* +| outputcsv *", "* +| outputlookup *", "* +| run *", "* +| script *", "* +| sendalert *", "* +| sendemail *", "* +| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type +| `drop_dm_object_name(Search_Activity)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `splunk_command_and_scripting_interpreter_risky_commands_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **splunk_command_and_scripting_interpreter_risky_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Search_Activity.search +* Search_Activity.info +* Search_Activity.total_run_time +* Search_Activity.user +* Search_Activity.savedsearch_name +* Search_Activity.search_type + + +#### How To Implement +To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +False positives will be present until properly filtered by Username and search name. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 20.0 | 50 | 40 | A risky Splunk command has ran by $user$ and should be reviewed. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md b/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md new file mode 100644 index 0000000000..2592448e3b --- /dev/null +++ b/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md @@ -0,0 +1,162 @@ +--- +title: "Splunk protocol impersonation weak encryption simplerequest" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-24 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-24 +- **Author**: Rod Soto, Splunk +- **ID**: 839d12a6-b119-4d44-ac4f-13eed95412c8 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1588.004](https://attack.mitre.org/techniques/T1588/004/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" +| stats count by host path +| `splunk_protocol_impersonation_weak_encryption_simplerequest_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunk_python](https://github.com/splunk/security_content/blob/develop/macros/splunk_python.yml) + +> :information_source: +> **splunk_protocol_impersonation_weak_encryption_simplerequest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* host +* event_message +* path + + +#### How To Implement +Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | Failed to validate certificate on $host$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security](https://www.splunk.com/en_us/product-security) +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md b/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md new file mode 100644 index 0000000000..6a235a7499 --- /dev/null +++ b/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md @@ -0,0 +1,166 @@ +--- +title: "Splunk Identified SSL TLS Certificates" +excerpt: "Network Sniffing +" +categories: + - Network +last_modified_at: 2022-05-25 +toc: true +toc_label: "" +tags: + - Network Sniffing + - Credential Access + - Discovery + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-25 +- **Author**: Michael Haag, Splunk +- **ID**: 620fbb89-86fd-4e2e-925f-738374277586 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1040](https://attack.mitre.org/techniques/T1040/) | Network Sniffing | Credential Access, Discovery | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Reconnaissance + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* +| stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype +| `splunk_identified_ssl_tls_certificates_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_identified_ssl_tls_certificates_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* ssl_issuer +* ssl_subject_common_name +* ssl_subject_organization +* ssl_subject +* host +* sourcetype + + +#### How To Implement +Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +False positives will not be present as it is meant to assist with identifying default certificates being utilized. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 42.0 | 60 | 70 | The following $dest$ is using the self signed Splunk certificate. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL](https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/network/splunk_identified_ssl_tls_certificates.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md b/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md new file mode 100644 index 0000000000..45bacf61e1 --- /dev/null +++ b/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md @@ -0,0 +1,167 @@ +--- +title: "Splunk Protocol Impersonation Weak Encryption Configuration" +excerpt: "Protocol Impersonation +" +categories: + - Application +last_modified_at: 2022-05-25 +toc: true +toc_label: "" +tags: + - Protocol Impersonation + - Command And Control + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-25 +- **Author**: Lou Stella, Splunk +- **ID**: 900892bf-70a9-4787-8c99-546dd98ce461 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1001.003](https://attack.mitre.org/techniques/T1001/003/) | Protocol Impersonation | Command And Control | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| rest /services/server/info +| table splunk_server version server_roles +| join splunk_server [ +| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" +| table splunk_server sslVerifyServerCert sslVerifyServerName] +| join splunk_server [ +| rest /servicesNS/nobody/search/configs/conf-web/settings +| table splunk_server serverCert sslVersions] +| rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" +| `splunk_protocol_impersonation_weak_encryption_configuration_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_protocol_impersonation_weak_encryption_configuration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* none + + +#### How To Implement +The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 50.0 | 50 | 100 | $splunk_server$ may not be properly validating TLS Certificates | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-macos_plutil.md b/docs/_posts/2022-05-26-macos_plutil.md index cb78981f6e..9d7140b763 100644 --- a/docs/_posts/2022-05-26-macos_plutil.md +++ b/docs/_posts/2022-05-26-macos_plutil.md @@ -109,8 +109,8 @@ Detect usage of plutil to modify plist files. Adversaries can modiy plist files #### Macros The SPL above uses the following Macros: -* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) > :information_source: > **macos_plutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md b/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md new file mode 100644 index 0000000000..f983cabd38 --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md @@ -0,0 +1,165 @@ +--- +title: "Splunk Digital Certificates Infrastructure Version" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Lou Stella, Splunk +- **ID**: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1587.003](https://attack.mitre.org/techniques/T1587/003/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| rest /services/server/info +| table splunk_server version server_roles +| join splunk_server [ +| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig" +| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] +| fillnull value="Not Set" +| rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" +| `splunk_digital_certificates_infrastructure_version_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_digital_certificates_infrastructure_version_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* none + + +#### How To Implement +The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +No known at this time. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 50.0 | 50 | 100 | $splunk_server$ may not be properly validating TLS Certificates | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication) +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_digital_certificates_infrastructure_version.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md b/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md new file mode 100644 index 0000000000..cd8a5b7f2b --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md @@ -0,0 +1,165 @@ +--- +title: "Splunk Digital Certificates Lack of Encryption" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Lou Stella, Splunk +- **ID**: 386a7ebc-737b-48cf-9ca8-5405459ed508 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1587.003](https://attack.mitre.org/techniques/T1587/003/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunkd` group="tcpin_connections" ssl="false" +| stats values(sourceIp) latest(fwdType) latest(version) by hostname +| `splunk_digital_certificates_lack_of_encryption_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) + +> :information_source: +> **splunk_digital_certificates_lack_of_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* group +* ssl +* sourceIp +* fwdType +* version +* hostname + + +#### How To Implement +This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +None at this time + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 20.0 | 25 | 80 | $hostname$ is not using TLS when forwarding data | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html) +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_digital_certificates_lack_of_encryption.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md new file mode 100644 index 0000000000..cfb560b194 --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md @@ -0,0 +1,166 @@ +--- +title: "Splunk Process Injection Forwarder Bundle Downloads" +excerpt: "Process Injection +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Lou Stella, Splunk +- **ID**: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunkd` component="PackageDownloadRestHandler" +| stats values(app) values(serverclass) by peer, host +| `splunk_process_injection_forwarder_bundle_downloads_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) + +> :information_source: +> **splunk_process_injection_forwarder_bundle_downloads_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* component +* app +* serverclass +* peer +* host + + +#### How To Implement +This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +None at this time. + +#### Associated Analytic story +* [Splunk Vulnerabilites](/stories/splunk_vulnerabilites) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 35.0 | 50 | 70 | $peer$ downloaded apps from $host$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md b/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md new file mode 100644 index 0000000000..88cca6ad70 --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md @@ -0,0 +1,162 @@ +--- +title: "Splunk protocol impersonation weak encryption selfsigned" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Rod Soto, Splunk +- **ID**: c76c7a2e-df49-414a-bb36-dce2683770de + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1588.004](https://attack.mitre.org/techniques/T1588/004/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunkd` certificate event_message="X509 certificate* should not be used*" +| stats count by host CN component log_level +| `splunk_protocol_impersonation_weak_encryption_selfsigned_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) + +> :information_source: +> **splunk_protocol_impersonation_weak_encryption_selfsigned_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* host +* CN +* event_message + + +#### How To Implement +Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | Splunk default issued certificate at $host$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security](https://www.splunk.com/en_us/product-security) +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md new file mode 100644 index 0000000000..1f47edb329 --- /dev/null +++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md @@ -0,0 +1,170 @@ +--- +title: "Splunk Command and Scripting Interpreter Delete Usage" +excerpt: "Command and Scripting Interpreter +" +categories: + - Application +last_modified_at: 2022-05-27 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Splunk_Audit +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) +- **Last Updated**: 2022-05-27 +- **Author**: Michael Haag, Splunk +- **ID**: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("* +| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type +| `drop_dm_object_name(Search_Activity)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `splunk_command_and_scripting_interpreter_delete_usage_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **splunk_command_and_scripting_interpreter_delete_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Search_Activity.search +* Search_Activity.info +* Search_Activity.total_run_time +* Search_Activity.user +* Search_Activity.savedsearch_name +* Search_Activity.search_type + + +#### How To Implement +To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. + +#### Known False Positives +False positives may be present if this command is used as a common practice. Filter as needed. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 27.0 | 90 | 30 | $user$ executed the 'delete' command, if this is unexpected it should be reviewed. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md new file mode 100644 index 0000000000..e6e8cc21a6 --- /dev/null +++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md @@ -0,0 +1,176 @@ +--- +title: "Splunk Command and Scripting Interpreter Risky SPL MLTK" +excerpt: "Command and Scripting Interpreter +" +categories: + - Application +last_modified_at: 2022-05-27 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Splunk_Audit +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) +- **Last Updated**: 2022-05-27 +- **Author**: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +- **ID**: 19d0146c-2eae-4e53-8d39-1198a78fa9ca + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.AE + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 6 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("* +| runshellscript *", "* +| collect *","* +| delete *", "* +| fit *", "* +| outputcsv *", "* +| outputlookup *", "* +| run *", "* +| script *", "* +| sendalert *", "* +| sendemail *", "* +| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h +| apply risky_command_abuse +| fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) +| rename IsOutlier(run_time) as isOutlier, _time as timestamp +| where isOutlier>0.5 +| `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_command_and_scripting_interpreter_risky_spl_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Search_Activity.search +* Search_Activity.total_run_time +* Search_Activity.user +* Search_Activity.search_type + + +#### How To Implement +This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. + +#### Known False Positives +If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 20.0 | 50 | 40 | Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt](https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md new file mode 100644 index 0000000000..174eac3cf3 --- /dev/null +++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md @@ -0,0 +1,170 @@ +--- +title: "MSHTML Module Load in Office Product" +excerpt: "Phishing +, Spearphishing Attachment +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Phishing + - Spearphishing Attachment + - Initial Access + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-40444 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Michael Haag, Mauricio Velazco, Splunk +- **ID**: 5f1c168e-118b-11ec-84ff-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + +| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + +
+
+ +#### Search + +``` +`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `mshtml_module_load_in_office_product_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* ImageLoaded +* process_name +* OriginalFileName +* process_id +* dest + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Known False Positives +Limited false positives will be present, however, tune as necessary. + +#### Associated Analytic story +* [Spearphishing Attachments](/stories/spearphishing_attachments) +* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444) +* [https://strontic.github.io/xcyclopedia/index-dll](https://strontic.github.io/xcyclopedia/index-dll) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/mshtml_module_load_in_office_product.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md new file mode 100644 index 0000000000..a841bd35e8 --- /dev/null +++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md @@ -0,0 +1,170 @@ +--- +title: "Suspicious Process With Discord DNS Query" +excerpt: "Visual Basic +, Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Visual Basic + - Command and Scripting Interpreter + - Execution + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk +- **ID**: 4d4332ae-792c-11ec-89c1-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" +| stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `suspicious_process_with_discord_dns_query_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Image +* QueryName +* QueryStatus +* process_name +* QueryResults +* Computer + + +#### How To Implement +his detection relies on sysmon logs with the Event ID 22, DNS Query. + +#### Known False Positives +Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. + +#### Associated Analytic story +* [WhisperGate](/stories/whispergate) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) +* [https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3](https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3) +* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md new file mode 100644 index 0000000000..8cc453ba00 --- /dev/null +++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md @@ -0,0 +1,165 @@ +--- +title: "Wermgr Process Connecting To IP Check Web Services" +excerpt: "Gather Victim Network Information +, IP Addresses +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Gather Victim Network Information + - IP Addresses + - Reconnaissance + - Reconnaissance + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk +- **ID**: ed313326-a0f9-11eb-a89c-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | + +| [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") +| stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_connecting_to_ip_check_web_services_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* process_path +* process_name +* process_id +* QueryName +* QueryStatus +* QueryResults +* Computer +* EventCode + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Trickbot](/stories/trickbot) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 56.0 | 70 | 80 | Wermgr.exe process connecting IP location web services on $ComputerName$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) +* [https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html](https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md new file mode 100644 index 0000000000..08612d4668 --- /dev/null +++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md @@ -0,0 +1,171 @@ +--- +title: "Windows InstallUtil Credential Theft" +excerpt: "InstallUtil +, System Binary Proxy Execution +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - InstallUtil + - System Binary Proxy Execution + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like MimiKatz. \ +When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ +If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-06-01 +- **Author**: Michael Haag, Mauricio Velazo, Splunk +- **ID**: ccfeddec-43ec-11ec-b494-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_installutil_credential_theft_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Known False Positives +Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed. + +#### Associated Analytic story +* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0](https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_installutil_credential_theft.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md index 93e889596e..0acdbed77f 100644 --- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md @@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md index 062660f7ef..a6397c199f 100644 --- a/docs/_stories/splunk_vulnerabilities.md +++ b/docs/_stories/splunk_vulnerabilities.md @@ -7,6 +7,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - Splunk_Audit + - Actions on Objectives - Delivery - Exploitation - Reconnaissance @@ -19,7 +21,7 @@ tags: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) - **Last Updated**: 2022-03-28 - **Author**: Lou Stella, Splunk - **ID**: 5354df00-dce2-48ac-9a64-8adb48006828 @@ -33,11 +35,20 @@ This analytic story includes detections that focus on attacker behavior targeted | Name | Technique | Type | | ----------- | ----------- |--------------| | [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery)| TTP | +| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | +| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting | +| [Splunk Command and Scripting Interpreter Risky SPL MLTK](/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | +| [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | +| [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates)| Anomaly | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service)| TTP | +| [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation)| Hunting | +| [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | +| [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | | [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts)| TTP | | [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | | [Open Redirect in Splunk Web](/deprecated/open_redirect_in_splunk_web/) | None| TTP | | [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None| TTP | +| [Splunk Identified SSL TLS Certificates](/network/splunk_identified_ssl_tls_certificates/) | [Network Sniffing](/tags/#network-sniffing)| Hunting | #### Reference diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index cf184a001b..6512d1e53b 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -9,11 +9,36 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/path_traversal_spl_injection.yml" }, + { + "techniqueID": "T1059", + "score": 43, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" + }, + { + "techniqueID": "T1587.003", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_digital_certificates_infrastructure_version.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_digital_certificates_lack_of_encryption.yml" + }, { "techniqueID": "T1498", "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_dos_via_malformed_s2s_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_arp_poisoning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_traffic_mirroring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/large_volume_of_dns_any_queries.yml" }, + { + "techniqueID": "T1055", + "score": 20, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" + }, + { + "techniqueID": "T1001.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml" + }, + { + "techniqueID": "T1588.004", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml" + }, { "techniqueID": "T1078", "score": 36, @@ -339,11 +364,6 @@ "score": 23, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_common_process_for_elevation_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_conf_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_chmod_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_setcap_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudo_or_su_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudoers_tmp_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_visudo_utility_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml" }, - { - "techniqueID": "T1059", - "score": 40, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" - }, { "techniqueID": "T1105", "score": 12, @@ -429,11 +449,6 @@ "score": 3, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml" }, - { - "techniqueID": "T1055", - "score": 19, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" - }, { "techniqueID": "T1485", "score": 17, @@ -1103,6 +1118,11 @@ "techniqueID": "T1498.002", "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/large_volume_of_dns_any_queries.yml" + }, + { + "techniqueID": "T1040", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/splunk_identified_ssl_tls_certificates.yml" } ], "gradient": { From b392ca9aa5aed60980ba7a50441e1130e704d718 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 14 Jun 2022 09:58:09 -0500 Subject: [PATCH 086/114] Update splunk_process_injection_forwarder_bundle_downloads.yml Spelling fix --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 4372fc3ac5..cf8263c8a8 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -14,7 +14,7 @@ references: - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - - Splunk Vulnerabilites + - Splunk Vulnerabilities asset_type: Endpoint cis20: - CIS 3 From 72c71bbfcb6763909c825b35376482afa34a06cb Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 14 Jun 2022 10:38:43 -0500 Subject: [PATCH 087/114] update site --- docs/_pages/stories.md | 2 +- .../2017-09-23-monitor_web_traffic_for_brand_abuse.md | 2 +- ...18-04-18-detect_spike_in_security_group_activity.md | 2 +- .../2018-05-21-detect_spike_in_network_acl_activity.md | 2 +- docs/_posts/2018-12-03-remote_wmi_command_attempt.md | 2 +- docs/_posts/2018-12-06-suspicious_java_classes.md | 2 +- ...3-detect_credential_dumping_through_lsass_access.md | 2 +- .../2019-12-03-detect_mimikatz_using_loaded_images.md | 2 +- ...2019-12-06-access_lsass_memory_for_dump_creation.md | 2 +- .../2019-12-06-create_remote_thread_into_lsass.md | 2 +- .../2019-12-06-unsigned_image_loaded_by_lsass.md | 2 +- .../2020-02-03-creation_of_lsass_dump_with_taskmgr.md | 2 +- docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md | 2 +- ...-15-amazon_eks_kubernetes_cluster_scan_detection.md | 2 +- ...0-04-15-amazon_eks_kubernetes_pod_scan_detection.md | 2 +- ...2020-05-20-first_time_seen_child_process_of_zoom.md | 2 +- .../2020-07-21-attempt_to_stop_security_service.md | 2 +- ..._requests_to_phishing_sites_leveraging_evilginx2.md | 10 +++++----- ...ous_powershell_process_-_execution_policy_bypass.md | 2 +- ...2-suspicious_writes_to_system_volume_information.md | 2 +- ...7-28-detect_windows_dns_sigred_via_splunk_stream.md | 2 +- ...16-create_or_delete_windows_shares_using_net_exe.md | 2 +- ...-detect_prohibited_applications_spawning_cmd_exe.md | 2 +- ...8-system_processes_run_from_unexpected_locations.md | 2 +- ...12-14-sunburst_correlation_dll_and_network_event.md | 2 +- ...-12-suspicious_microsoft_workflow_compiler_usage.md | 2 +- docs/_posts/2021-01-12-suspicious_msbuild_spawn.md | 2 +- ...ect_hosts_connecting_to_dynamic_domain_providers.md | 2 +- ...s_powershell_process_with_obfuscation_techniques.md | 2 +- .../2021-01-20-detect_rundll32_inline_hta_execution.md | 2 +- docs/_posts/2021-01-20-suspicious_mshta_spawn.md | 2 +- ...01-28-detect_regsvr32_application_control_bypass.md | 2 +- ...-28-suspicious_regsvr32_register_suspicious_path.md | 2 +- .../2021-02-01-dump_lsass_via_procdump_rename.md | 2 +- ...ct_rundll32_application_control_bypass_-_advpack.md | 2 +- ...t_rundll32_application_control_bypass_-_setupapi.md | 2 +- ...t_rundll32_application_control_bypass_-_syssetup.md | 2 +- docs/_posts/2021-02-04-suspicious_rundll32_startw.md | 2 +- ...2021-02-09-suspicious_rundll32_dllregisterserver.md | 2 +- docs/_posts/2021-03-03-nishang_powershelltcponeline.md | 2 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 4 ++-- .../2021-03-12-ransomware_notes_bulk_creation.md | 2 +- .../2021-03-16-high_process_termination_frequency.md | 2 +- .../2021-03-16-windows_high_file_deletion_frequency.md | 2 +- .../_posts/2021-03-29-powershell_start-bitstransfer.md | 2 +- docs/_posts/2021-04-12-excel_spawning_powershell.md | 2 +- docs/_posts/2021-04-12-winword_spawning_powershell.md | 2 +- ...-04-13-office_application_spawn_rundll32_process.md | 2 +- ...021-04-14-office_document_creating_schedule_task.md | 2 +- .../2021-04-14-office_document_executing_macro_code.md | 2 +- ...owershell_remote_thread_to_known_windows_process.md | 2 +- ...2021-04-19-wermgr_process_create_executable_file.md | 2 +- ...wermgr_process_spawned_cmd_or_powershell_process.md | 4 ++-- ...1-04-21-multiple_archive_files_http_post_traffic.md | 2 +- ...-22-office_product_spawning_rundll32_with_no_dll.md | 2 +- .../2021-04-22-plain_http_post_exfiltrated_data.md | 2 +- docs/_posts/2021-04-22-winword_spawning_cmd.md | 2 +- .../2021-04-26-office_product_spawning_bitsadmin.md | 2 +- .../_posts/2021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 2 +- .../_posts/2021-04-29-suspicious_driver_loaded_path.md | 2 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 2 +- docs/_posts/2021-05-04-deleting_of_net_users.md | 2 +- docs/_posts/2021-05-04-disabling_net_user_account.md | 2 +- .../2021-05-04-excessive_service_stop_attempt.md | 2 +- .../2021-05-04-process_kill_base_on_file_path.md | 2 +- .../_posts/2021-05-06-download_files_using_telegram.md | 2 +- docs/_posts/2021-05-06-excessive_usage_of_net_app.md | 2 +- docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 2 +- docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- docs/_posts/2021-06-02-modification_of_wallpaper.md | 2 +- .../_posts/2021-06-02-wbemprox_com_object_execution.md | 2 +- ...-06-16-detect_wmi_event_subscription_persistence.md | 2 +- ...06-22-recursive_delete_of_directory_in_batch_cmd.md | 2 +- ...2021-06-24-excessive_usage_of_sc_service_utility.md | 2 +- ...2021-07-01-print_spooler_adding_a_printer_driver.md | 2 +- ...021-07-01-print_spooler_failed_to_load_a_plug-in.md | 2 +- docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md | 2 +- .../2021-07-01-spoolsv_suspicious_loaded_modules.md | 2 +- .../2021-07-01-spoolsv_suspicious_process_access.md | 2 +- .../2021-07-01-spoolsv_writing_a_dll_-_sysmon.md | 2 +- ...021-07-05-powershell_disable_security_monitoring.md | 2 +- .../2021-07-12-uac_bypass_mmc_load_unsigned_dll.md | 2 +- ...7-19-mshta_spawning_rundll32_or_regsvr32_process.md | 4 ++-- .../2021-07-19-office_product_spawn_cmd_process.md | 2 +- ...021-07-26-rundll32_createremotethread_in_browser.md | 2 +- ...21-07-26-rundll32_process_creating_exe_dll_files.md | 2 +- .../2021-07-26-suspicious_icedid_rundll32_cmdline.md | 2 +- .../2021-07-26-suspicious_rundll32_plugininit.md | 2 +- ...-07-27-regsvr32_with_known_silent_switch_cmdline.md | 2 +- ...07-29-rundll32_create_remote_thread_to_a_process.md | 2 +- docs/_posts/2021-07-30-drop_icedid_license_dat.md | 2 +- ...-07-30-icedid_exfiltrated_archived_file_creation.md | 2 +- ...-07-30-office_application_spawn_regsvr32_process.md | 2 +- docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md | 2 +- ...-08-04-create_remote_thread_in_shell_application.md | 2 +- .../2021-08-13-uac_bypass_with_colorui_com_object.md | 2 +- ...2021-08-24-domain_account_discovery_with_net_app.md | 2 +- .../2021-08-24-kubernetes_scanner_image_pulling.md | 2 +- .../2021-08-27-exchange_powershell_abuse_via_ssrf.md | 2 +- .../2021-09-01-circle_ci_disable_security_step.md | 2 +- ...2021-09-01-github_pull_request_from_unknown_user.md | 2 +- .../2021-09-02-circle_ci_disable_security_job.md | 2 +- ...che_change_by_app_connect_and_create_adsi_object.md | 2 +- docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md | 2 +- ...rundll32_control_rundll_world_writable_directory.md | 2 +- docs/_posts/2021-09-09-extraction_of_registry_hives.md | 2 +- ...1-09-13-ms_scripting_process_loading_ldap_module.md | 2 +- ...21-09-13-ms_scripting_process_loading_wmi_module.md | 2 +- .../2021-09-13-xsl_script_execution_with_wmic.md | 2 +- .../2021-09-16-account_discovery_with_net_app.md | 2 +- ...empted_credential_dump_from_registry_via_reg_exe.md | 2 +- docs/_posts/2021-09-16-bits_job_persistence.md | 2 +- docs/_posts/2021-09-16-bitsadmin_download_file.md | 2 +- ...creation_of_shadow_copy_with_wmic_and_powershell.md | 4 ++-- ...ential_dumping_via_copy_command_from_shadow_copy.md | 2 +- ...16-credential_dumping_via_symlink_to_shadow_copy.md | 2 +- .../2021-09-16-detect_html_help_url_in_command_line.md | 2 +- ...detect_html_help_using_infotech_storage_handlers.md | 2 +- .../2021-09-16-detect_mshta_inline_hta_execution.md | 2 +- .../2021-09-16-detect_mshta_url_in_command_line.md | 2 +- docs/_posts/2021-09-16-dump_lsass_via_procdump.md | 2 +- .../2021-09-16-local_account_discovery_with_net.md | 2 +- .../2021-09-16-local_account_discovery_with_wmic.md | 2 +- docs/_posts/2021-09-16-office_product_spawning_wmic.md | 2 +- docs/_posts/2021-09-29-verclsid_clsid_execution.md | 2 +- ...-04-msbuild_suspicious_spawned_by_script_process.md | 2 +- ...04-regsvr32_silent_and_install_param_dll_loading.md | 2 +- docs/_posts/2021-10-05-rundll32_shimcache_flush.md | 2 +- .../_posts/2021-10-06-sdelete_application_execution.md | 2 +- ...0-14-serviceprincipalnames_discovery_with_setspn.md | 2 +- ...1-10-19-windows_curl_download_to_suspicious_path.md | 2 +- ...-11-10-windows_curl_upload_to_remote_destination.md | 2 +- docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md | 2 +- .../2021-11-12-csc_net_on_the_fly_compilation.md | 2 +- ...-11-12-network_discovery_using_route_windows_app.md | 2 +- .../2021-11-12-remote_process_instantiation_via_wmi.md | 2 +- .../2021-11-12-windows_installutil_uninstall_option.md | 2 +- ...21-11-12-windows_installutil_url_in_command_line.md | 2 +- ...te_process_instantiation_via_dcom_and_powershell.md | 2 +- ...ote_process_instantiation_via_wmi_and_powershell.md | 2 +- ...e_process_instantiation_via_winrm_and_powershell.md | 2 +- docs/_posts/2021-11-18-loading_of_dynwrapx_module.md | 2 +- ...021-12-08-msi_module_loaded_by_non-system_binary.md | 2 +- docs/_posts/2021-12-13-windows_java_spawning_shells.md | 2 +- ...ershell_-_connect_to_internet_with_hidden_window.md | 2 +- ...2-windows_hunting_system_account_targeting_lsass.md | 2 +- ...01-12-windows_non-system_account_targeting_lsass.md | 2 +- ...022-01-18-cmd_carry_out_string_command_parameter.md | 2 +- ...8-malicious_powershell_process_-_encoded_command.md | 2 +- ...cious_process_dns_query_known_abuse_web_services.md | 2 +- ...01-19-windows_dotnet_binary_in_non_standard_path.md | 2 +- ...2-01-19-windows_installutil_in_non_standard_path.md | 2 +- ...20-excessive_file_deletion_in_windefender_folder.md | 2 +- docs/_posts/2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-27-windows_possible_credential_dumping.md | 2 +- ..._kerberos_ticket_exports_through_winlogon_access.md | 2 +- ...02-07-windows_remote_assistance_spawning_process.md | 2 +- .../_posts/2022-02-08-rundll_loading_dll_by_ordinal.md | 2 +- ...7-windows_raw_access_to_master_boot_record_drive.md | 2 +- ...2022-02-18-detect_regasm_with_network_connection.md | 2 +- ...022-02-18-detect_regsvcs_with_network_connection.md | 2 +- ...022-02-18-process_deleting_its_process_file_path.md | 2 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 2 +- .../2022-02-22-windows_wmi_process_call_create.md | 2 +- ...2-25-windows_raw_access_to_disk_volume_partition.md | 2 +- docs/_posts/2022-03-08-suspicious_msbuild_path.md | 2 +- ...15-detect_regsvcs_with_no_command_line_arguments.md | 2 +- ...ll32_with_no_command_line_arguments_with_network.md | 2 +- ...15-suspicious_gpupdate_no_command_line_arguments.md | 2 +- ...15-suspicious_rundll32_no_command_line_arguments.md | 2 +- ...16-windows_installutil_remote_network_connection.md | 2 +- ...indows_installutil_uninstall_option_with_network.md | 2 +- .../2022-03-28-windows_terminating_lsass_process.md | 2 +- .../2022-03-30-windows_drivers_loaded_by_signature.md | 2 +- ...04-06-web_spring4shell_http_request_class_module.md | 2 +- docs/_posts/2022-04-07-any_powershell_downloadfile.md | 2 +- .../_posts/2022-04-07-any_powershell_downloadstring.md | 2 +- .../_posts/2022-04-18-nltest_domain_trust_discovery.md | 2 +- ...windows_processes_killed_by_industroyer2_malware.md | 2 +- docs/_posts/2022-05-16-cobalt_strike_named_pipes.md | 2 +- ...unk_process_injection_forwarder_bundle_downloads.md | 2 +- .../2022-06-01-mshtml_module_load_in_office_product.md | 2 +- ...-06-01-suspicious_process_with_discord_dns_query.md | 2 +- ...rmgr_process_connecting_to_ip_check_web_services.md | 2 +- .../2022-06-01-windows_installutil_credential_theft.md | 2 +- .../2022-06-03-excessive_usage_of_nslookup_app.md | 2 +- docs/_stories/splunk_vulnerabilities.md | 1 + 188 files changed, 196 insertions(+), 195 deletions(-) diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 18efa21234..abecdac106 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -109,7 +109,7 @@ sidebar: | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None | -| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | +| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 051f22e654..4457943a64 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -101,8 +101,8 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) > :information_source: > **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index bbb21c3187..ba87d130b6 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index c5f5fd575e..7e2378e968 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 7f77a75359..cc8964e565 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -111,8 +111,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 3e1d527e90..6fa26f2d66 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index be75b3546b..875ff5b43e 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 3de046b373..445b0aa8ec 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index ade57132a5..6228d32f4a 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index be36a668be..01a8bca88b 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index f7818c9cf6..6ce1a2e91d 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index d877cebd94..e89e183dd1 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 6a0338fdad..9f92f7ce49 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -113,8 +113,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 1309557b22..f8e8536bb0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) > :information_source: > **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 881939da87..a963f0417f 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) > :information_source: > **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 1164dc80d2..ada1ed7f59 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 45e497632d..58dbbdc38f 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -119,8 +119,8 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index c51c767f06..46dae84eb1 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) +* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 5f60fe9322..9372642573 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 2ba8eb08fa..9b0f587725 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index ed73e8c274..906d51e1ca 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) * [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) +* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) > :information_source: > **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index b18c0297cb..16df731e66 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -114,8 +114,8 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 5e95657880..40a0588ba7 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -114,9 +114,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 4ae024d1ea..617e428b64 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -116,8 +116,8 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 7e4aa6a628..fd49f87ac7 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index a9eda9f12e..56ad8afeab 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -108,8 +108,8 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 2981f697b7..3fb78bf21f 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index acb9fc9e9c..f3ff99120f 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -113,8 +113,8 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index c82dde054d..d264511cc0 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 9dd8f0fe7a..76b85517e1 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -112,8 +112,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 7c5c6ff72c..80f40c2548 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 6c37af2788..bf8e91a006 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -113,8 +113,8 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index f9cf1a3efd..67902820ae 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -112,8 +112,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index beea6f235b..f790f144d3 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 5a903ef10e..735dd33b8a 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index e305c8b68c..c1f594b00a 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index d8c9000127..4f41ad6e86 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 63ee241b2a..01e838de9a 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index bc208c5e86..be4d30aed2 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 130f7c6dcd..082d8597ae 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 3eca1c53ab..ab18079b5d 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 620ce0a918..18070e75e0 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index db41bf7dfa..d4cf37746f 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index 5ac8414b89..b73da35928 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 69da9eb447..5583fced4f 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 20d0073cd2..a7a8420e93 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 501c9660d5..89a771922f 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 75a6897250..395cc1b89a 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 56c059af2a..bef8758516 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index d2d52c4271..eeb3ab4fee 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 85a2c57319..000c69e486 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index a3a7e05749..caf4fa1b8e 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 4cdbd433e0..42583c9bdf 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index f787b8f414..ec93fceb92 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index e0ae691ef6..c40ab2bb31 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 2f4662d6e8..8b9810d35a 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 1d6f90aadf..fb37b43389 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -108,8 +108,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 1678be0cca..83ac9784e0 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 23dc5d2084..e1e4038175 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 895a6c51d5..cc29fc4eab 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 43c3a38d63..ff1e142ac3 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index aea92238c8..7046351428 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index cb96058580..bc7dfa7f87 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -103,8 +103,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index e183e6433d..535a631c2c 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -103,8 +103,8 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index d04c52af26..7e62bef14e 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -104,8 +104,8 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 7832bc24d5..bbecb9975f 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -108,8 +108,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index e75d99cd23..43eaa37a0b 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 5024c92f03..9cbb027826 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -104,8 +104,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 869bea7299..64ff8b9995 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 09d1324b0b..1ed5f0e08d 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -120,8 +120,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index 5286c0105c..bb4baa84c7 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index f095875738..aa6d560171 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index d2bde70c61..72713207b3 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index 18aeadf0f2..a11edd86b5 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -108,8 +108,8 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index f3fa23324d..849bccd29b 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index a0f829606a..2ce03df914 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) > :information_source: > **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index d5094a4a8e..081961e406 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) > :information_source: > **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 57fa4e8b70..1972abccfb 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -114,8 +114,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index c3db511f1e..bbc1985d5b 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index 406084fcfc..a22067412c 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 20678262d5..72cefff943 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index b7f5ee265e..324bc9edb8 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index 6f9d39c5bf..c9f070f3ec 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 251e2c5e25..18015756a1 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -107,10 +107,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) > :information_source: > **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 2d76b31dca..1038195192 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -108,8 +108,8 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index ef3e261bdf..7ee60a9e83 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 2612bc03e8..2fee621286 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index fa9fa4b335..e574e6f691 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 14846a2e0e..2c4448604c 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index a70a85e8c3..27cbb5c585 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -109,8 +109,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 57dd88fc58..fdf4ec8c06 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 229fecc735..35acb6bef9 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 1f2de9c0c4..7ee2b55ee4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index d478b8a1dc..ae7b48391d 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 24da952f26..e3ec1efb85 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 2d8501f31d..bf0db94672 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 3fb4417f2a..65a9387f53 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index b006f6f12e..ed38bcefb7 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index d63185fdba..db880108c1 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -111,8 +111,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### Macros The SPL above uses the following Macros: -* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) > :information_source: > **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 27495bc909..a4109f88e7 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 71a252f6f8..9e27a6d39f 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -117,8 +117,8 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) > :information_source: > **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 2d64e0e59c..5472ee8db6 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 136c9bacd3..735373a9e4 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -113,8 +113,8 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) > :information_source: > **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 64cb7c7e3c..5f1e7fe3f7 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index a6cbdb54f1..134b9a1a46 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -112,8 +112,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index d74d500fcd..9e7b8b4572 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -112,8 +112,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 906af392f7..a39d5f8422 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -108,8 +108,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: > **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 397b2fde50..3b0d396361 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 9b34319ea7..d0dc7976de 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 34a46ae1ab..7799ae5de6 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -103,8 +103,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index ef8f22531b..7eede94a27 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -109,8 +109,8 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 9aa29771a0..03592ce7d2 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -114,9 +114,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 65b5026013..1de2af652c 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -104,8 +104,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index e430f829c2..d2c8c7bf2d 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -109,8 +109,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index d5760a955e..7b9f556da7 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,10 +112,10 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 6b569688ce..f6f060195b 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -113,8 +113,8 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 21b44df3dd..d6a564ecf3 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -113,8 +113,8 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 2301b8a300..a314652ee7 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) > :information_source: > **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 879ffee11e..f7fe599fd1 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) > :information_source: > **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 917308ab5f..778d8b6ff4 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -113,8 +113,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 6d3b9fd3f3..7ec5743895 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -113,8 +113,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 1a41c5629e..71034b077f 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index f8eb2e3127..b1aa6cdf31 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index df514a0d38..34a3d5138b 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 82fd721322..eed2b96620 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 81c53e695d..be4fd3f7ba 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,9 +107,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) > :information_source: > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 18327b1dbb..26d9c2b9b0 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -108,8 +108,8 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 9a0aea5cea..9014907709 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -109,8 +109,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index f51ec23ad7..a3863a8678 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -102,8 +102,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 435972ee36..d81e1b179e 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -112,9 +112,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: -* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) > :information_source: > **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 7a1f5eedc5..28feffa6ea 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -110,8 +110,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) > :information_source: > **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 22720e91d1..4320088985 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -105,8 +105,8 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index fe5471fb42..1aa535fe1c 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -107,8 +107,8 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 83bfac410c..3e2d9784e0 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -103,8 +103,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 52abb47d1e..3a1c7dbb39 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -108,8 +108,8 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) > :information_source: > **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 1f87ace6f7..971dd3bbde 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -108,8 +108,8 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) > :information_source: > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 41a3561c9d..59357aa8f6 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -111,8 +111,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 215c786252..1eb00cabc5 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,9 +111,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index dfc676e66c..528f6b0294 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,9 +110,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 73a0c311f5..37b92ca050 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index f50a85740c..133e5e5ae1 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index 458e515aef..d611b7f432 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 1c834b88c8..ab844da06b 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index 180db1a279..d94c2cff62 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index e831d6cb09..4a076c35c3 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -110,8 +110,8 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) > :information_source: > **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index 5b55936c2f..a7e3a6be4d 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index ee9b513261..58ff38a98a 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index cc2eb7766c..c48ad067c4 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index b0cb5436ae..70436ece37 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -113,8 +113,8 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index 383cc57008..f58ff3f639 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index 02fb93e350..b4a40a14d5 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index d77807e154..12c713a123 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -119,8 +119,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) > :information_source: > **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 58e4d0e11d..921bf0c555 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,9 +117,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 837ffae589..f0282edf5f 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index cc3548f17a..548baa0f37 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -116,8 +116,8 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) > :information_source: > **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index 7799ba7e41..e89c702ca3 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index 7e85cb86f9..df18dc6ceb 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 750df54c18..e5645065c1 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -104,8 +104,8 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) > :information_source: > **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 1ca1e1d4f7..64239bc1a7 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index 12bd46fc7a..39f2b80d72 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index b8e76acd2d..51d1e73d56 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 6c6367c37c..663285a202 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index d2e44a1965..fe11db54f8 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index d2f3c5bda6..75b9319c65 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 65ca269f9e..354377901f 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -109,8 +109,8 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 539abbfa7f..8585a4f9e0 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index f3a0b01783..cdc1d04670 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -123,8 +123,8 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index 2a33a397b7..a4972826ff 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index 4c780c3d97..61890d3fea 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index f1df36b2c2..8b4e61d37a 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 3805e9254b..1124eaa96f 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index a695f6e7b7..02546a0eed 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,9 +115,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index e7ffbdeb55..4eba7529a2 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,9 +116,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 42ee8d7ce7..424eff1d3a 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index c503983391..f5be1cf051 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index d73eeffe74..aa65234c4a 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -113,8 +113,8 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index 65e39d055c..329d185ff5 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index d7ba5d5cc3..4ed02b76f5 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 7192ee4b40..4502ff62f6 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -108,8 +108,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) > :information_source: > **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index 7249744d4d..b10e220124 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index 562a6beea7..484b31b7fd 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md index cfb560b194..7476b0ef44 100644 --- a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md +++ b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md @@ -132,7 +132,7 @@ This hunting search uses native logs produced when a deployment server is within None at this time. #### Associated Analytic story -* [Splunk Vulnerabilites](/stories/splunk_vulnerabilites) +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md index 174eac3cf3..b18ce4fe3e 100644 --- a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md @@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md index a841bd35e8..d62428fbc2 100644 --- a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md @@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md index 8cc453ba00..cdc455112a 100644 --- a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md @@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md index 08612d4668..41f5193809 100644 --- a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md +++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md @@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md index 0acdbed77f..93e889596e 100644 --- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md @@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md index a6397c199f..112db56d1a 100644 --- a/docs/_stories/splunk_vulnerabilities.md +++ b/docs/_stories/splunk_vulnerabilities.md @@ -41,6 +41,7 @@ This analytic story includes detections that focus on attacker behavior targeted | [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | | [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates)| Anomaly | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service)| TTP | +| [Splunk Process Injection Forwarder Bundle Downloads](/application/splunk_process_injection_forwarder_bundle_downloads/) | [Process Injection](/tags/#process-injection)| Hunting | | [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation)| Hunting | | [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | | [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | From 0cf536acd5cf4f399ad3e0d8320d542c2a50c621 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Tue, 14 Jun 2022 20:13:42 -0700 Subject: [PATCH 088/114] fix path error --- ...nk_command_and_scripting_interpreter_risky_spl_mltk.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml index 00c80c42b7..94b5ff8a0f 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml @@ -1,7 +1,7 @@ name: Splunk Command and Scripting Interpreter Risky SPL MLTK Unit Test tests: - name: Splunk Command and Scripting Interpreter Risky SPL MLTK - file: splunk_command_and_scripting_interpreter_risky_spl_mltk.yml + file: application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml pass_condition: '| stats count | where count > 0' earliest_time: -1h latest_time: now From 863259df93a12b4a1bdf8c5fa9447172afffe3e0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 15 Jun 2022 13:49:56 -0500 Subject: [PATCH 089/114] Updated per #2235 --- .../network/detect_unauthorized_assets_by_mac_address.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml index 949fe28962..ec528dbb12 100644 --- a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml @@ -1,6 +1,6 @@ name: Detect Unauthorized Assets by MAC address id: dcfd6b40-42f9-469d-a433-2e53f7489ff4 -version: 1 +version: 2 date: '2017-09-13' author: Bhavin Patel, Splunk type: TTP @@ -13,7 +13,7 @@ description: By populating the organization's assets within the assets_by_str.cs associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Sessions - where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip + where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter`' From dbf1c528649f7592edd8449a0669704d12068d75 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 16 Jun 2022 13:08:02 -0500 Subject: [PATCH 090/114] Update splunk_process_injection_forwarder_bundle_downloads.yml --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index cf8263c8a8..1e0ca4536d 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -22,7 +22,6 @@ tags: - CIS 16 cve: - CVE-2022-32157 - - CVE-2022-32158 confidence: 70 context: - Source:Endpoint From 9a25da4387c3bd67b52196b963351bcbbe59bad3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 17 Jun 2022 09:36:34 -0600 Subject: [PATCH 091/114] T1218.007 - MSIExec --- .../windows_msiexec_dllregisterserver.yml | 81 +++++++++++++++++++ ...ws_msiexec_load_from_non_standard_path.yml | 81 +++++++++++++++++++ .../windows_msiexec_remote_download.yml | 81 +++++++++++++++++++ ...indows_msiexec_spawn_discovery_command.yml | 80 ++++++++++++++++++ ...s_msiexec_unregister_dllregisterserver.yml | 80 ++++++++++++++++++ ...ndows_msiexec_with_network_connections.yml | 80 ++++++++++++++++++ macros/process_msiexec.yml | 3 + ..._system_binary_proxy_execution_msiexec.yml | 18 +++++ ...windows_msiexec_dllregisterserver.test.yml | 13 +++ ...iexec_load_from_non_standard_path.test.yml | 14 ++++ .../windows_msiexec_remote_download.test.yml | 13 +++ ...s_msiexec_spawn_discovery_command.test.yml | 13 +++ ...exec_unregister_dllregisterserver.test.yml | 14 ++++ ..._msiexec_with_network_connections.test.yml | 14 ++++ 14 files changed, 585 insertions(+) create mode 100644 detections/endpoint/windows_msiexec_dllregisterserver.yml create mode 100644 detections/endpoint/windows_msiexec_load_from_non_standard_path.yml create mode 100644 detections/endpoint/windows_msiexec_remote_download.yml create mode 100644 detections/endpoint/windows_msiexec_spawn_discovery_command.yml create mode 100644 detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml create mode 100644 detections/endpoint/windows_msiexec_with_network_connections.yml create mode 100644 macros/process_msiexec.yml create mode 100644 stories/windows_system_binary_proxy_execution_msiexec.yml create mode 100644 tests/endpoint/windows_msiexec_dllregisterserver.test.yml create mode 100644 tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml create mode 100644 tests/endpoint/windows_msiexec_remote_download.test.yml create mode 100644 tests/endpoint/windows_msiexec_spawn_discovery_command.test.yml create mode 100644 tests/endpoint/windows_msiexec_unregister_dllregisterserver.test.yml create mode 100644 tests/endpoint/windows_msiexec_with_network_connections.test.yml diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml new file mode 100644 index 0000000000..a928508c8f --- /dev/null +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -0,0 +1,81 @@ +name: Windows MSIExec DLLRegisterServer +id: fdb59aef-d88f-4909-8369-ec2afbd2c398 +version: 1 +date: '2022-06-14' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. + Upon triage, review parent process and capture any artifacts for further review. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` + Processes.process IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_msiexec_dllregisterserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. +references: + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file. + mitre_attack_id: + - T1218.007 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml b/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml new file mode 100644 index 0000000000..d2dc681ede --- /dev/null +++ b/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml @@ -0,0 +1,81 @@ +name: Windows MSIExec Load from Non-Standard Path +id: 42bb73c8-302c-45ce-9e87-2e81c2107725 +version: 1 +date: '2022-06-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies msiexec.exe running from a non-standard location. This is a commonly used method by adversaries to evade detection logic. + During triage, capture any file modification artifacts and review parallel processes. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` NOT (Processes.process_path IN ("*system32*","*syswow64*","*winsxs*")) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process_path + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_msiexec_load_from_non_standard_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present as some legitimate applications may use a moved or renamed instance of MSIExec. Filter as needed. +references: + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to run from a non-standard path. + mitre_attack_id: + - T1218.007 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml new file mode 100644 index 0000000000..69ba719e45 --- /dev/null +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -0,0 +1,81 @@ +name: Windows MSIExec Remote Download +id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda +version: 1 +date: '2022-06-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it. + During triage, review parallel processes and capture any artifacts on disk for review. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_msiexec_remote_download_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present, filter by destination or parent process as needed. +references: + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file. + mitre_attack_id: + - T1218.007 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml new file mode 100644 index 0000000000..2d34188916 --- /dev/null +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -0,0 +1,80 @@ +name: Windows MSIExec Spawn Discovery Command +id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee +version: 1 +date: '2022-06-13' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies MSIExec spawning multiple discovery commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes are not common from MSIExec other than MSIExec spawning itself. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_msiexec_spawn_discovery_command_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query. +references: + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands. + mitre_attack_id: + - T1218.007 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml new file mode 100644 index 0000000000..594212f96d --- /dev/null +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -0,0 +1,80 @@ +name: Windows MSIExec Unregister DLLRegisterServer +id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 +version: 1 +date: '2022-06-14' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. + Upon triage, review parent process and capture any artifacts for further review. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` + Processes.process IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. +references: + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file. + mitre_attack_id: + - T1218.007 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_msiexec_with_network_connections.yml new file mode 100644 index 0000000000..9541707b9c --- /dev/null +++ b/detections/endpoint/windows_msiexec_with_network_connections.yml @@ -0,0 +1,80 @@ +name: Windows MSIExec With Network Connections +id: 827409a1-5393-4d8d-8da4-bbb297c262a7 +version: 1 +date: '2022-06-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies MSIExec with any network connection over port 443 or 80. Typically, MSIExec does not perform network communication to the internet. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_msiexec` by _time Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] + | table _time dest parent_process_name process_name process_path process process_id dest_port dest_ip + | `windows_msiexec_with_network_connections_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Add parent process as a filter, filter known good processes. This may be voluminous due to the join on process_id. All_Traffic does not have process_guid, yet. +known_false_positives: False positives will be present and filtering is required. +references: + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination. + mitre_attack_id: + - T1218.007 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_id + - Processes.process_name + - Processes.dest + - Processes.process_path + - Processes.process + - Processes.parent_process_name + - All_Traffic.process_id + - All_Traffic.dest + - All_Traffic.dest_port + - All_Traffic.dest_ip + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/macros/process_msiexec.yml b/macros/process_msiexec.yml new file mode 100644 index 0000000000..8d7889dbc0 --- /dev/null +++ b/macros/process_msiexec.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=msiexec.exe OR Processes.original_file_name=msiexec.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_msiexec \ No newline at end of file diff --git a/stories/windows_system_binary_proxy_execution_msiexec.yml b/stories/windows_system_binary_proxy_execution_msiexec.yml new file mode 100644 index 0000000000..9de4be3abe --- /dev/null +++ b/stories/windows_system_binary_proxy_execution_msiexec.yml @@ -0,0 +1,18 @@ +name: Windows System Binary Proxy Execution MSIExec +id: bea2e16b-4599-46ad-a95b-116078726c68 +version: 1 +date: '2022-06-16' +author: Michael Haag, Splunk +description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). +narrative: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled. +references: + - https://attack.mitre.org/techniques/T1218/007/ +tags: + analytic_story: Windows System Binary Proxy Execution MSIExec + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/endpoint/windows_msiexec_dllregisterserver.test.yml b/tests/endpoint/windows_msiexec_dllregisterserver.test.yml new file mode 100644 index 0000000000..77b83217ec --- /dev/null +++ b/tests/endpoint/windows_msiexec_dllregisterserver.test.yml @@ -0,0 +1,13 @@ +name: Windows MSIExec DLLRegisterServer Unit Test +tests: +- name: Windows MSIExec DLLRegisterServer + file: endpoint/windows_msiexec_dllregisterserver.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml new file mode 100644 index 0000000000..1f887e3599 --- /dev/null +++ b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml @@ -0,0 +1,14 @@ +name: Windows MSIExec Load from Non-Standard Path Unit + Test +tests: +- name: Windows MSIExec Load from Non-Standard Path + file: endpoint/windows_msiexec_load_from_non_standard_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_msiexec_remote_download.test.yml b/tests/endpoint/windows_msiexec_remote_download.test.yml new file mode 100644 index 0000000000..892e22af74 --- /dev/null +++ b/tests/endpoint/windows_msiexec_remote_download.test.yml @@ -0,0 +1,13 @@ +name: Windows MSIExec Remote Download Unit Test +tests: +- name: Windows MSIExec Remote Download + file: endpoint/windows_msiexec_remote_download.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_msiexec_spawn_discovery_command.test.yml b/tests/endpoint/windows_msiexec_spawn_discovery_command.test.yml new file mode 100644 index 0000000000..017eba6a12 --- /dev/null +++ b/tests/endpoint/windows_msiexec_spawn_discovery_command.test.yml @@ -0,0 +1,13 @@ +name: Windows MSIExec Spawn Discovery Command Unit Test +tests: +- name: Windows MSIExec Spawn Discovery Command + file: endpoint/windows_msiexec_spawn_discovery_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_msiexec_unregister_dllregisterserver.test.yml b/tests/endpoint/windows_msiexec_unregister_dllregisterserver.test.yml new file mode 100644 index 0000000000..fcf3c441ad --- /dev/null +++ b/tests/endpoint/windows_msiexec_unregister_dllregisterserver.test.yml @@ -0,0 +1,14 @@ +name: Windows MSIExec Unregister DLLRegisterServer Unit + Test +tests: +- name: Windows MSIExec Unregister DLLRegisterServer + file: endpoint/windows_msiexec_unregister_dllregisterserver.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_msiexec_with_network_connections.test.yml b/tests/endpoint/windows_msiexec_with_network_connections.test.yml new file mode 100644 index 0000000000..cd4f8047b5 --- /dev/null +++ b/tests/endpoint/windows_msiexec_with_network_connections.test.yml @@ -0,0 +1,14 @@ +name: Windows MSIExec With Network Connections Unit + Test +tests: +- name: Windows MSIExec With Network Connections + file: endpoint/windows_msiexec_with_network_connections.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 2788e8e63c2024aacc231197a4c536d4e0c66e8f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 17 Jun 2022 10:22:24 -0600 Subject: [PATCH 092/114] path fix --- .../windows_msiexec_load_from_non_standard_path.yml | 2 +- .../windows_msiexec_load_from_non_standard_path.test.yml | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml b/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml index d2dc681ede..48f9e0e66a 100644 --- a/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml +++ b/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml @@ -34,7 +34,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml index 1f887e3599..50ab188259 100644 --- a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml +++ b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml @@ -7,8 +7,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog update_timestamp: true From 56394444ceab729d664b625e66a930fcb8c65cb7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 17 Jun 2022 13:09:37 -0600 Subject: [PATCH 093/114] fix --- ...ndows_msiexec_load_from_non_standard_path.test.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml index 50ab188259..7a3b9dba3e 100644 --- a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml +++ b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml @@ -1,5 +1,4 @@ -name: Windows MSIExec Load from Non-Standard Path Unit - Test +name: Windows MSIExec Load from Non-Standard Path Unit Test tests: - name: Windows MSIExec Load from Non-Standard Path file: endpoint/windows_msiexec_load_from_non_standard_path.yml @@ -7,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + - file_name: msiexec_moved.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/msiexec_moved.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true From 53bc5dcda49985a2182621e591ddd9194d8edd75 Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 20 Jun 2022 16:33:35 -0400 Subject: [PATCH 094/114] fixing incorrect story pointer --- detections/endpoint/winword_spawning_windows_script_host.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 8b221e113b..89d781fbc0 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -31,7 +31,7 @@ references: - https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - - Spearphishing Attachment + - Spearphishing Attachments confidence: 100 context: - Source:Endpoint From 8ca9ac7b5769931c56614ede021d31d7846b629f Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 21 Jun 2022 12:05:52 -0700 Subject: [PATCH 095/114] adding urltoolbox and spl updates --- bin/docker_detection_tester/modules/validate_args.py | 6 ++++++ bin/docker_detection_tester/test_config_github_actions.json | 5 +++++ detections/endpoint/potential_password_in_username.yml | 1 - 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 7d870c4781..7e3a653246 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -156,6 +156,12 @@ setup_schema = { "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + }, + } }, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 36fc631670..335347df68 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -79,6 +79,11 @@ "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" } }, "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index fa50c36988..a9f32c11d6 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -28,7 +28,6 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` - | `potential_password_in_username_false_positive_reduction` | eval incorrect_password=\"$incorrect_password$\" | eval ut_shannon=\"$ut_shannon$\" | sort count" From a92a6f2546b6eceacf87b6d512b5a4024adba67e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 21 Jun 2022 12:24:04 -0700 Subject: [PATCH 096/114] map filter --- detections/endpoint/potential_password_in_username.yml | 1 + ...potential_password_in_username_false_positive_reduction.yml | 3 +++ 2 files changed, 4 insertions(+) create mode 100644 macros/potential_password_in_username_false_positive_reduction.yml diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index a9f32c11d6..fa50c36988 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -28,6 +28,7 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` + | `potential_password_in_username_false_positive_reduction` | eval incorrect_password=\"$incorrect_password$\" | eval ut_shannon=\"$ut_shannon$\" | sort count" diff --git a/macros/potential_password_in_username_false_positive_reduction.yml b/macros/potential_password_in_username_false_positive_reduction.yml new file mode 100644 index 0000000000..e8555b4f55 --- /dev/null +++ b/macros/potential_password_in_username_false_positive_reduction.yml @@ -0,0 +1,3 @@ +definition: search * +description: Add customer specific known false positives to the map command used in detection - Potential password in username +name: potential_password_in_username_false_positive_reduction \ No newline at end of file From 85f4f107a3757d0d34d27cd3a8b4287d9a0ffe38 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 21 Jun 2022 14:45:43 -0500 Subject: [PATCH 097/114] Changed to anomaly --- .../endpoint}/rundll32_lockworkstation.yml | 4 ++-- tests/endpoint/rundll32_lockworkstation.test.yml | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) rename {investigations => detections/endpoint}/rundll32_lockworkstation.yml (98%) create mode 100644 tests/endpoint/rundll32_lockworkstation.test.yml diff --git a/investigations/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml similarity index 98% rename from investigations/rundll32_lockworkstation.yml rename to detections/endpoint/rundll32_lockworkstation.yml index f20d95d919..9afac9f1f1 100644 --- a/investigations/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -1,9 +1,9 @@ name: Rundll32 LockWorkStation id: fa90f372-f91d-11eb-816c-acde48001122 -version: 1 +version: 2 date: '2021-08-09' author: Teoderick Contreras, Splunk -type: Investigation +type: Anomaly datamodel: - Endpoint description: This search is to detect a suspicious rundll32 commandline to lock the diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml new file mode 100644 index 0000000000..4d2c2ec50d --- /dev/null +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -0,0 +1,12 @@ +rname: Rundll32 LockWorkStation Unit Test +tests: +- name: Rundll32 LockWorkStation + file: endpoint/rundll32_lockworkstation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From c98d7b68550a308b9a2e217b9de8a8d4bc06cb2a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 12:52:32 -0700 Subject: [PATCH 098/114] Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest. --- .../detection_testing_execution.py | 20 +++++-------------- .../modules/splunk_container.py | 12 ++++++++++- .../modules/testing_service.py | 9 ++++----- bin/docker_detection_tester/modules/utils.py | 15 ++++++++++++++ 4 files changed, 35 insertions(+), 21 deletions(-) create mode 100644 bin/docker_detection_tester/modules/utils.py diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 4d9f1898f2..990d6a8d66 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -29,9 +29,10 @@ import requests.packages.urllib3 from docker.client import DockerClient from requests import get -import modules.new_arguments2 + + from modules import (container_manager, new_arguments2, - testing_service, validate_args) + testing_service, validate_args, utils) from modules.github_service import GithubService from modules.validate_args import validate, validate_and_write, ES_APP_NAME @@ -56,17 +57,6 @@ MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING = 2 -def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False)->None: - if os.path.exists(destination_file) and overwrite_file is False: - print(f"[{destination_file}] already exists...using cached version") - return - print(f"downloading to [{destination_file}]") - file_to_download = requests.get(url, stream=True) - with open(destination_file, "wb") as output: - for piece in file_to_download.iter_content(chunk_size=(1024*1024)): - output.write(piece) - - def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tuple[str,None] = None, splunkbase_password:tuple[str,None] = None, mock:bool = False, target_directory:str = "apps") -> str: if mock is True: target_directory = os.path.join("prior_config", target_directory) @@ -128,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable base_name = path_after_host.rpartition('/')[-1] #just get the file name dest_path = os.path.join(target_directory, base_name) #write the whole path - download_file_from_http(http_path, dest_path) + utils.download_file_from_http(http_path, dest_path) #we need to update the local path because this is used to copy it into the container later item['local_path'] = dest_path #Remove the HTTP Path, we will use the local_path instead @@ -341,7 +331,7 @@ def main(args: list[str]): start_datetime = datetime.now() - action, settings = modules.new_arguments2.parse(args) + action, settings = new_arguments2.parse(args) if action == "configure": # Done, nothing else to do print("Configuration complete!") diff --git a/bin/docker_detection_tester/modules/splunk_container.py b/bin/docker_detection_tester/modules/splunk_container.py index 1c2c3c7f28..52c07ba832 100644 --- a/bin/docker_detection_tester/modules/splunk_container.py +++ b/bin/docker_detection_tester/modules/splunk_container.py @@ -455,8 +455,18 @@ class SplunkContainer: #pdb.set_trace() # Fill in all the "Empty" fields with default values. Otherwise, we will not be able to # process the result correctly. + detection_to_test.replace("security_content/tests", "security_content/detections") + try: + test_file_obj = testing_service.load_file(os.path.join("security_content/", detection_to_test)) + if 'file' not in test_file_obj: + raise Exception(f"'file' field not found in {detection_to_test}") + except: + test_file_obj['file'] = detection_to_test.replace("tests/", "").replace(".test.yml", ".yml") + print(f"Error getting the detection file associated with the test file. We will try our best to convert it: {detection_to_test}-->{test_file_obj['file']}") + + self.synchronization_object.addError( - {"detection_file": detection_to_test, + {"detection_file": test_file_obj['file'], "detection_error": str(e)}, duration_string = datetime.timedelta(seconds=round(timeit.default_timer() - current_test_start_time)) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 00fd03d3e8..72b39cfc69 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -9,6 +9,7 @@ import os import time import requests from modules.DataManipulation import DataManipulation +from modules import utils from modules import splunk_sdk import timeit from typing import Union, Tuple @@ -103,12 +104,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa data_upload_index = splunk_sdk.DEFAULT_DATA_INDEX indices_to_delete.add(data_upload_index) - - r = requests.get(url, allow_redirects=True) + target_file = os.path.join(folder_name, attack_data['file_name']) - with open(target_file, 'wb') as target: - target.write(r.content) - #print(target_file) + utils.download_file_from_http(url, target_file) + # Update timestamps before replay diff --git a/bin/docker_detection_tester/modules/utils.py b/bin/docker_detection_tester/modules/utils.py new file mode 100644 index 0000000000..c818e44bc0 --- /dev/null +++ b/bin/docker_detection_tester/modules/utils.py @@ -0,0 +1,15 @@ +import os +import requests + + +def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size=1024*1024)->None: + if os.path.exists(destination_file) and overwrite_file is False: + print(f"[{destination_file}] already exists...using cached version") + return + print(f"downloading to [{destination_file}]") + file_to_download = requests.get(url, stream=True) + if file_to_download.status_code != 200: + raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") + with open(destination_file, "wb") as output: + for piece in file_to_download.iter_content(chunk_size=chunk_size): + output.write(piece) \ No newline at end of file From e681b766c22a11e2602fb0e01fc16dea5564ef3b Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 21 Jun 2022 14:59:48 -0500 Subject: [PATCH 099/114] Fixing field name --- tests/endpoint/rundll32_lockworkstation.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml index 4d2c2ec50d..2e913208f4 100644 --- a/tests/endpoint/rundll32_lockworkstation.test.yml +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -1,4 +1,4 @@ -rname: Rundll32 LockWorkStation Unit Test +name: Rundll32 LockWorkStation Unit Test tests: - name: Rundll32 LockWorkStation file: endpoint/rundll32_lockworkstation.yml From 6b06ab718b1d5c247ded51e67b8c978313128245 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 13:13:50 -0700 Subject: [PATCH 100/114] Fixing a link to a dataset that has been moved. --- tests/endpoint/linux_at_allow_config_file_creation.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/linux_at_allow_config_file_creation.test.yml b/tests/endpoint/linux_at_allow_config_file_creation.test.yml index c070af54f3..b8ffb65369 100644 --- a/tests/endpoint/linux_at_allow_config_file_creation.test.yml +++ b/tests/endpoint/linux_at_allow_config_file_creation.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: sysmon_linux.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon_linux From 575cd80e017aadc2908d65ae3eb5c1e93b7bea7e Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 21 Jun 2022 15:17:25 -0500 Subject: [PATCH 101/114] Updated observable & asset_type --- detections/endpoint/rundll32_lockworkstation.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 9afac9f1f1..3a596146e7 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -46,7 +46,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process Name role: - Attacker product: @@ -65,3 +65,4 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint + asset_type: Endpoint \ No newline at end of file From 5762b4e3738eb4c3fd09807d006901293dbc7520 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 13:53:26 -0700 Subject: [PATCH 102/114] Updated the app baseline as well as the python code for generating the default config. Also updated the print behavior for when files are downloaded. App baseline is now current, and files are hosted on S3, as of 06/21/2022. --- .../detection_testing_execution.py | 2 +- bin/docker_detection_tester/modules/utils.py | 24 +- .../modules/validate_args.py | 137 +++++------ .../test_config_github_actions.json | 226 +++++++++--------- 4 files changed, 199 insertions(+), 190 deletions(-) diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 990d6a8d66..2b58110445 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -118,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable base_name = path_after_host.rpartition('/')[-1] #just get the file name dest_path = os.path.join(target_directory, base_name) #write the whole path - utils.download_file_from_http(http_path, dest_path) + utils.download_file_from_http(http_path, dest_path, verbose_print=True) #we need to update the local path because this is used to copy it into the container later item['local_path'] = dest_path #Remove the HTTP Path, we will use the local_path instead diff --git a/bin/docker_detection_tester/modules/utils.py b/bin/docker_detection_tester/modules/utils.py index c818e44bc0..6671e16367 100644 --- a/bin/docker_detection_tester/modules/utils.py +++ b/bin/docker_detection_tester/modules/utils.py @@ -2,14 +2,22 @@ import os import requests -def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size=1024*1024)->None: +def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size:int=1024*1024, verbose_print:bool=False)->None: if os.path.exists(destination_file) and overwrite_file is False: print(f"[{destination_file}] already exists...using cached version") return - print(f"downloading to [{destination_file}]") - file_to_download = requests.get(url, stream=True) - if file_to_download.status_code != 200: - raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") - with open(destination_file, "wb") as output: - for piece in file_to_download.iter_content(chunk_size=chunk_size): - output.write(piece) \ No newline at end of file + if verbose_print: + print(f"downloading to [{destination_file}]...",end="") + try: + file_to_download = requests.get(url, stream=True) + if file_to_download.status_code != 200: + if verbose_print: + print("FAILED") + raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") + with open(destination_file, "wb") as output: + for piece in file_to_download.iter_content(chunk_size=chunk_size): + output.write(piece) + except Exception as e: + if verbose_print: + print("FAILED") + raise e \ No newline at end of file diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 7d870c4781..6f6fde9ed1 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -52,13 +52,13 @@ setup_schema = { "additionalProperties": False, "properties": { "app_number": { - "type": ["integer","null"] + "type": ["integer", "null"] }, "app_version": { - "type": ["string","null"] + "type": ["string", "null"] }, "local_path": { - "type": ["string","null"] + "type": ["string", "null"] }, "http_path": { "type": ["string", "null"] @@ -66,71 +66,36 @@ setup_schema = { }, "anyOf": [ {"required": ["local_path"]}, - {"required": ["http_path"] }, - {"required": ["app_number", "app_version"] }, + {"required": ["http_path"]}, + {"required": ["app_number", "app_version"]}, ] } }, "default": { - ES_APP_NAME : { + ES_APP_NAME: { "app_number": 3449, "app_version": None, "local_path": None }, - #The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template + # The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" }, "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { "app_number": 2882, "app_version": "3.0.2", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { "app_number": 3719, "app_version": "1.3.2", @@ -138,25 +103,60 @@ setup_schema = { }, "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" }, "SPLUNK_ADD_ON_FOR_NGINX": { "app_number": 3258, "app_version": "3.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, "SPLUNK_TA_FOR_ZEEK": { "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - }, - + } + } }, @@ -227,9 +227,9 @@ setup_schema = { "type": "array", "items": { "type": "string", - "enum": ["endpoint", "cloud", "network","web","application", "experimental"] + "enum": ["endpoint", "cloud", "network", "web", "application", "experimental"] }, - "default": ["endpoint", "cloud", "network","web", "application"] + "default": ["endpoint", "cloud", "network", "web", "application"] }, "types": { @@ -252,7 +252,7 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]: raise(e) -def check_dependencies(settings: dict, skip_password_accessibility_check:bool=True) -> bool: +def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool: # Check complex mode dependencies error_free = True @@ -268,20 +268,19 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr) error_free = False - # Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed if skip_password_accessibility_check: pass elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False: print("\n\n******************************************************\n\n") if settings['splunk_app_password'] is not None: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and provided a password in the config file. We will NOT print this password to\n"\ - "stdout. Look in the config file for this password.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and provided a password in the config file. We will NOT print this password to\n" + "stdout. Look in the config file for this password.", file=sys.stderr) else: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"\ - "to True for you. Otherwise, interactive mode login would be impossible.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n" + "to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr) settings['show_splunk_app_password'] = True print("\n\n******************************************************\n\n") @@ -289,7 +288,7 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr return error_free -def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: closeFile = False if output_file is None: import datetime @@ -305,7 +304,8 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, configuration['container_password'] = None configuration['show_splunk_app_password'] = True - validated_json, setup_schema = validate(configuration,skip_password_accessibility_check) + validated_json, setup_schema = validate( + configuration, skip_password_accessibility_check) if validated_json == None: print("Error in the new settings! No output file written") else: @@ -324,7 +324,7 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, return validated_json, setup_schema -def validate(configuration: dict, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: # v = jsonschema.Draft201909Validator(argument_schema) try: @@ -334,7 +334,8 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) - if len(validation_errors) == 0: # check to make sure there were no complex errors - no_complex_errors = check_dependencies(validated_json,skip_password_accessibility_check) + no_complex_errors = check_dependencies( + validated_json, skip_password_accessibility_check) if no_complex_errors: return validated_json, setup_schema else: diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 36fc631670..5b664c4d4a 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -1,114 +1,114 @@ { - "apps": { - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - } - }, - "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", - "commit_hash": null, - "container_tag": "latest", - "detections_list": null, - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": false, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "changes", - "no_interactive_failure": true, - "num_containers": 10, - "persist_security_content": false, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + } + }, + "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", + "commit_hash": null, + "container_tag": "latest", + "detections_list": null, + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": false, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "changes", + "no_interactive_failure": true, + "num_containers": 10, + "persist_security_content": false, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} \ No newline at end of file From 6554d4a42b9e87e07a1491650181d2ec4cef5b62 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 13:59:50 -0700 Subject: [PATCH 103/114] Moved ssa___ test file from the tests/network directory to the tests/experimental/endpoint directory because that's where the corresponding detection resides. --- ...mmand_and_scripting_interpreter_outbound_ldap_traffic.test.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/{ => experimental}/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml (100%) diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml similarity index 100% rename from tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml rename to tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml From 26f6bbfc924662f4439dc447ec7035157b33b255 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 14:29:11 -0700 Subject: [PATCH 104/114] Adding the URL_TOOLBOX app to the application baseline. --- bin/docker_detection_tester/modules/validate_args.py | 7 ++++++- .../test_config_github_actions.json | 5 +++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 6f6fde9ed1..411f395e52 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -155,7 +155,12 @@ setup_schema = { "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - } + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + }, } }, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 5b664c4d4a..126ab4d2c1 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -79,6 +79,11 @@ "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" } }, "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", From aa228e84be3e0ae3818ac7b5641869334f72b227 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 21 Jun 2022 14:55:19 -0700 Subject: [PATCH 105/114] hunting --- detections/endpoint/potential_password_in_username.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index fa50c36988..ee672b6ca4 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -3,7 +3,7 @@ id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 version: 1 date: '2022-05-11' author: Mikael Bjerkeland, Splunk -type: Anomaly +type: Hunting datamodel: - Authentication description: This search identifies users who have entered their passwords in username From 7816778eae31326989ee331887e6562611b90631 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 15:45:00 -0700 Subject: [PATCH 106/114] Removed the field "user" from the stats line. It does not appear to exist in the raw data and is not pulled into any field(s). However, there is a field called userName which, presumably, represents the same data. --- detections/cloud/aws_ecr_container_scanning_findings_high.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index e298eeafc7..8df8f80d8b 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -1,7 +1,7 @@ name: AWS ECR Container Scanning Findings High id: 62721bd2-1d82-4623-b6e6-aac170014423 version: 1 -date: '2021-08-17' +date: '2022-06-21' author: Patrick Bareiss, Splunk type: TTP datamodel: [] @@ -14,7 +14,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) - as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, + as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This From b5c79b6db891f798a30678feba0227064c64e87c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 15:53:26 -0700 Subject: [PATCH 107/114] Added a custom index for a detection test that was created when custom_index support did not yet exist. --- tests/application/splunk_dos_via_malformed_s2s_request.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml index d2780a45e8..e17643a313 100644 --- a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml +++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml @@ -11,3 +11,4 @@ tests: source: /opt/splunk/var/log/splunk/splunkd.log sourcetype: splunkd update_timestamp: true + custom_index: _internal From 35908f5a304df9f608972a5a462402bdfdc554c5 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 16:25:20 -0700 Subject: [PATCH 108/114] Removed user from the stats call of this search since it does not exist and the field userName does exist. And it is likely to have captured the same data. --- detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index 388e2254b3..3b3ce65eca 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -15,7 +15,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, - user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` + userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. From 8d040371251a059a413b3d3fe033fd0e8f43942a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 21 Jun 2022 16:28:05 -0700 Subject: [PATCH 109/114] Update windows_impair_defenses_disable_win_defender_auto_logging.yml --- ...dows_impair_defenses_disable_win_defender_auto_logging.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 3701411852..ec4d4bf177 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when anadversary gains access to an endpoint + behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. @@ -72,4 +72,4 @@ tags: risk_score: 24 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon \ No newline at end of file + - Splunk_TA_microsoft_sysmon From b73ea9e5aefe73b77e150534a0fbc3cbdf410873 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 16:59:44 -0700 Subject: [PATCH 110/114] Added another custom_index to a test file that was failing because it did not have one. --- tests/application/path_traversal_spl_injection.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/application/path_traversal_spl_injection.test.yml b/tests/application/path_traversal_spl_injection.test.yml index f40d6cd7db..c59e89061f 100644 --- a/tests/application/path_traversal_spl_injection.test.yml +++ b/tests/application/path_traversal_spl_injection.test.yml @@ -10,3 +10,4 @@ tests: data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt source: c:\opt\splunk\var\log\splunk\splunkd_ui_access.log sourcetype: splunkd_ui_access + custom_index: _internal From 54203d68582fd6d5e51673dda1b41b74cb92b0a1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 17:21:30 -0700 Subject: [PATCH 111/114] Fixing detection to conform to new sysmon behavior. --- detections/endpoint/office_document_executing_macro_code.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 83a6ebc88d..bd6d5aecb7 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") +search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` From 52fa6467a97d2ea24cafbc3e8306d9bd66100c54 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 22 Jun 2022 09:17:14 -0500 Subject: [PATCH 112/114] Updated per customer feedback --- .../ssa___windows_lolbin_binary_in_non_standard_path.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index e619bd2d73..44f29b9c6c 100644 --- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -1,7 +1,7 @@ name: Windows LOLBin Binary in Non Standard Path id: 25689101-012a-324a-94d3-08301e6c065a -version: 1 -date: '2022-03-18' +version: 2 +date: '2022-06-22' author: Michael Haag, Splunk type: Anomaly datamodel: @@ -29,7 +29,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false - AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp, + AND match_regex(process_path, /(?i)\\microsoft.net/)=false AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. From 7ef25a98ec32eee7a5f0179db2e3d0aa21dee579 Mon Sep 17 00:00:00 2001 From: research bot Date: Wed, 22 Jun 2022 17:56:19 +0000 Subject: [PATCH 113/114] updating docs and package bits [ci skip] --- dist/escu/app.manifest | 2 +- dist/escu/default/analyticstories.conf | 74 ++++-- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 26 +- dist/escu/default/savedsearches.conf | 243 +++++++++++++++--- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- ...ows_lolbin_binary_in_non_standard_path.yml | 3 +- docs/_pages/detections.md | 5 + docs/_pages/stories.md | 6 +- ...tect_unauthorized_assets_by_mac_address.md | 4 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 2 +- ...detect_spike_in_security_group_activity.md | 2 +- ...21-detect_spike_in_network_acl_activity.md | 2 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 2 +- ...-10-23-wmi_permanent_event_subscription.md | 2 +- ...-10-23-wmi_temporary_event_subscription.md | 2 +- .../2018-12-06-suspicious_java_classes.md | 2 +- .../2019-04-25-suspicious_file_write.md | 2 +- ...credential_dumping_through_lsass_access.md | 2 +- ...-03-detect_mimikatz_using_loaded_images.md | 2 +- ...6-access_lsass_memory_for_dump_creation.md | 2 +- ...9-12-06-create_remote_thread_into_lsass.md | 2 +- ...19-12-06-unsigned_image_loaded_by_lsass.md | 2 +- ...-03-creation_of_lsass_dump_with_taskmgr.md | 2 +- .../2020-02-21-dump_lsass_via_comsvcs_dll.md | 2 +- .../2020-03-16-detect_rare_executables.md | 2 +- ...0-first_time_seen_child_process_of_zoom.md | 2 +- .../2020-07-06-windows_event_log_cleared.md | 2 +- ...-07-21-attempt_to_stop_security_service.md | 4 +- ..._to_phishing_sites_leveraging_evilginx2.md | 10 +- ...web_traffic_to_dynamic_domain_providers.md | 2 +- ...ce_modified_with_previously_unseen_user.md | 2 +- ...first_time_seen_running_windows_service.md | 2 +- ...shell_process_-_execution_policy_bypass.md | 2 +- ...th_invalid_credentials_from_the_same_ip.md | 2 +- .../2020-07-21-okta_failed_sso_attempts.md | 2 +- ...1-okta_user_logins_from_multiple_cities.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- ...ous_writes_to_system_volume_information.md | 2 +- ...20-07-22-uncommon_processes_on_endpoint.md | 2 +- .../_posts/2020-08-11-detect_arp_poisoning.md | 2 +- .../2020-08-11-detect_rogue_dhcp_server.md | 2 +- ..._or_delete_windows_shares_using_net_exe.md | 4 +- ...ect_ipv6_network_infrastructure_threats.md | 2 +- ...20-10-28-detect_port_security_violation.md | 2 +- .../2020-10-28-detect_traffic_mirroring.md | 2 +- ...2020-11-09-common_ransomware_extensions.md | 2 +- .../2020-11-09-common_ransomware_notes.md | 2 +- ..._system_network_configuration_discovery.md | 2 +- ...rohibited_applications_spawning_cmd_exe.md | 6 +- ...burst_correlation_dll_and_network_event.md | 2 +- ...12-15-o365_suspicious_rights_delegation.md | 2 +- .../2020-12-16-o365_pst_export_alert.md | 2 +- ...-o365_suspicious_admin_email_forwarding.md | 2 +- ...6-o365_suspicious_user_email_forwarding.md | 2 +- .../2021-01-12-suspicious_msbuild_spawn.md | 2 +- ...ell_process_with_obfuscation_techniques.md | 2 +- ...20-detect_rundll32_inline_hta_execution.md | 2 +- .../2021-01-20-suspicious_mshta_spawn.md | 2 +- ...o365_add_app_role_assignment_grant_user.md | 2 +- ...1-01-26-o365_excessive_sso_logon_errors.md | 2 +- ...1-01-26-o365_new_federated_domain_added.md | 2 +- ...ect_regsvr32_application_control_bypass.md | 2 +- ...cious_regsvr32_register_suspicious_path.md | 2 +- ...21-02-01-dump_lsass_via_procdump_rename.md | 2 +- ...32_application_control_bypass_-_advpack.md | 2 +- ...2_application_control_bypass_-_setupapi.md | 2 +- ...2_application_control_bypass_-_syssetup.md | 2 +- .../2021-02-04-suspicious_rundll32_startw.md | 2 +- ...9-suspicious_rundll32_dllregisterserver.md | 2 +- ...2021-03-03-nishang_powershelltcponeline.md | 2 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 4 +- ...21-03-12-ransomware_notes_bulk_creation.md | 2 +- ...3-16-high_process_termination_frequency.md | 2 +- ...16-windows_high_file_deletion_frequency.md | 2 +- ...3-17-clop_ransomware_known_service_name.md | 2 +- ...021-03-23-certutil_with_decode_argument.md | 2 +- ...021-03-29-powershell_start-bitstransfer.md | 2 +- ...021-03-31-disabling_firewall_with_netsh.md | 2 +- ...icious_powershell_executed_as_a_service.md | 2 +- .../2021-04-12-excel_spawning_powershell.md | 2 +- .../2021-04-12-winword_spawning_powershell.md | 2 +- ...12-winword_spawning_windows_script_host.md | 2 +- ...fice_application_spawn_rundll32_process.md | 2 +- ...-office_document_creating_schedule_task.md | 2 +- ...14-office_document_executing_macro_code.md | 4 +- ..._remote_thread_to_known_windows_process.md | 2 +- ...9-wermgr_process_create_executable_file.md | 2 +- ...ocess_spawned_cmd_or_powershell_process.md | 4 +- ...ultiple_archive_files_http_post_traffic.md | 2 +- ...e_product_spawning_rundll32_with_no_dll.md | 2 +- ...-04-22-plain_http_post_exfiltrated_data.md | 2 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 2 +- ...04-26-office_product_spawning_bitsadmin.md | 2 +- ...-04-26-office_product_spawning_certutil.md | 2 +- ...021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 2 +- ...021-04-29-suspicious_driver_loaded_path.md | 2 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 2 +- .../2021-05-04-deleting_of_net_users.md | 4 +- .../2021-05-04-disabling_net_user_account.md | 4 +- ...21-05-04-excessive_service_stop_attempt.md | 4 +- ...021-05-06-download_files_using_telegram.md | 2 +- .../2021-05-06-excessive_usage_of_net_app.md | 4 +- ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 2 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- .../2021-06-02-modification_of_wallpaper.md | 2 +- ...021-06-02-wbemprox_com_object_execution.md | 2 +- ...-04-known_services_killed_by_ransomware.md | 2 +- ...tect_wmi_event_subscription_persistence.md | 2 +- ...ursive_delete_of_directory_in_batch_cmd.md | 2 +- ...w_file_and_printing_sharing_in_firewall.md | 2 +- ...-23-allow_network_discovery_in_firewall.md | 2 +- ...4-excessive_usage_of_sc_service_utility.md | 2 +- ...1-print_spooler_adding_a_printer_driver.md | 2 +- ...-print_spooler_failed_to_load_a_plug-in.md | 2 +- .../2021-07-01-spoolsv_spawning_rundll32.md | 2 +- ...07-01-spoolsv_suspicious_loaded_modules.md | 2 +- ...07-01-spoolsv_suspicious_process_access.md | 2 +- ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md | 2 +- ...-powershell_disable_security_monitoring.md | 2 +- ...-07-12-uac_bypass_mmc_load_unsigned_dll.md | 2 +- ...a_spawning_rundll32_or_regsvr32_process.md | 4 +- ...-07-19-office_product_spawn_cmd_process.md | 2 +- ...-rundll32_createremotethread_in_browser.md | 2 +- ...rundll32_process_creating_exe_dll_files.md | 2 +- ...7-26-suspicious_icedid_rundll32_cmdline.md | 2 +- ...21-07-26-suspicious_rundll32_plugininit.md | 2 +- ...gsvr32_with_known_silent_switch_cmdline.md | 2 +- ...dll32_create_remote_thread_to_a_process.md | 2 +- .../2021-07-30-drop_icedid_license_dat.md | 2 +- ...edid_exfiltrated_archived_file_creation.md | 2 +- ...fice_application_spawn_regsvr32_process.md | 2 +- ...2021-08-03-sqlite_module_in_temp_folder.md | 2 +- ...eate_remote_thread_in_shell_application.md | 2 +- .../2021-08-09-rundll32_lockworkstation.md | 165 ++++++++++++ ...8-13-uac_bypass_with_colorui_com_object.md | 2 +- ...8-16-gsuite_email_suspicious_attachment.md | 2 +- ..._ecr_container_scanning_findings_medium.md | 2 +- ...mail_with_attachment_to_external_domain.md | 2 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 2 +- ...9-aws_ecr_container_upload_unknown_user.md | 2 +- ...mail_suspicious_subject_with_attachment.md | 2 +- ...1-08-20-github_commit_changes_in_master.md | 2 +- ...2021-08-20-kubernetes_nginx_ingress_lfi.md | 2 +- ...email_with_known_abuse_web_service_link.md | 2 +- ...2021-08-23-kubernetes_nginx_ingress_rfi.md | 2 +- ...4-domain_account_discovery_with_net_app.md | 4 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 2 +- .../2021-09-01-github_commit_in_develop.md | 2 +- .../2021-09-01-github_dependabot_alert.md | 2 +- ...1-github_pull_request_from_unknown_user.md | 2 +- ...e_by_app_connect_and_create_adsi_object.md | 2 +- ...2021-09-08-rundll32_control_rundll_hunt.md | 2 +- ...control_rundll_world_writable_directory.md | 2 +- ...s_scripting_process_loading_ldap_module.md | 2 +- ...ms_scripting_process_loading_wmi_module.md | 2 +- ...21-09-16-account_discovery_with_net_app.md | 4 +- ...t_to_add_certificate_to_untrusted_store.md | 2 +- ...edential_dump_from_registry_via_reg_exe.md | 2 +- .../_posts/2021-09-16-bits_job_persistence.md | 2 +- .../2021-09-16-bitsadmin_download_file.md | 2 +- ...of_shadow_copy_with_wmic_and_powershell.md | 2 +- ...mping_via_copy_command_from_shadow_copy.md | 2 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 2 +- ...16-detect_html_help_url_in_command_line.md | 2 +- ...ml_help_using_infotech_storage_handlers.md | 2 +- ...09-16-detect_mshta_inline_hta_execution.md | 2 +- ...-09-16-detect_mshta_url_in_command_line.md | 2 +- ...9-16-detect_psexec_with_accepteula_flag.md | 2 +- .../2021-09-16-dump_lsass_via_procdump.md | 2 +- ...-09-16-local_account_discovery_with_net.md | 4 +- .../2021-09-16-processes_launching_netsh.md | 2 +- .../2021-09-29-verclsid_clsid_execution.md | 2 +- ...ld_suspicious_spawned_by_script_process.md | 2 +- ...32_silent_and_install_param_dll_loading.md | 2 +- .../2021-10-05-rundll32_shimcache_flush.md | 2 +- .../2021-10-05-suspicious_copy_on_system32.md | 2 +- ...iceprincipalnames_discovery_with_setspn.md | 2 +- ...indows_curl_download_to_suspicious_path.md | 4 +- ...ndows_curl_upload_to_remote_destination.md | 4 +- ...twork_discovery_using_route_windows_app.md | 2 +- ...21-11-12-runas_execution_in_commandline.md | 2 +- ...12-windows_installutil_uninstall_option.md | 2 +- ...windows_installutil_url_in_command_line.md | 2 +- ...s_instantiation_via_dcom_and_powershell.md | 2 +- ...ss_instantiation_via_wmi_and_powershell.md | 2 +- ..._instantiation_via_winrm_and_powershell.md | 2 +- .../2021-11-18-loading_of_dynwrapx_module.md | 2 +- ...info_gathering_using_dxdiag_application.md | 2 +- ...ce_created_with_suspicious_service_path.md | 2 +- ...dows_service_created_within_public_path.md | 2 +- ...-11-29-detect_rclone_command-line_usage.md | 2 +- ...-msi_module_loaded_by_non-system_binary.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 2 +- ...2021-12-13-windows_java_spawning_shells.md | 2 +- ..._connect_to_internet_with_hidden_window.md | 2 +- ..._hunting_system_account_targeting_lsass.md | 2 +- ...dows_non-system_account_targeting_lsass.md | 2 +- ...-cmd_carry_out_string_command_parameter.md | 2 +- ...us_powershell_process_-_encoded_command.md | 2 +- ...cess_dns_query_known_abuse_web_services.md | 2 +- ...dows_dotnet_binary_in_non_standard_path.md | 2 +- ...indows_installutil_in_non_standard_path.md | 2 +- ...ive_file_deletion_in_windefender_folder.md | 2 +- .../2022-01-20-ping_sleep_batch_command.md | 2 +- ...-27-windows_possible_credential_dumping.md | 2 +- ...nload_with_urlcache_and_split_arguments.md | 2 +- ...load_with_verifyctl_and_split_arguments.md | 2 +- ...2022-02-03-o365_added_service_principal.md | 2 +- ...22-02-03-o365_bypass_mfa_via_trusted_ip.md | 2 +- docs/_posts/2022-02-03-o365_disable_mfa.md | 2 +- ..._ticket_exports_through_winlogon_access.md | 2 +- ...dows_remote_assistance_spawning_process.md | 2 +- ...7-windows_schtasks_create_run_as_system.md | 2 +- ...022-02-08-rundll_loading_dll_by_ordinal.md | 2 +- ..._raw_access_to_master_boot_record_drive.md | 2 +- ...8-detect_regasm_with_network_connection.md | 2 +- ...-detect_regsvcs_with_network_connection.md | 2 +- ...excessive_authentication_failures_alert.md | 2 +- ...-process_deleting_its_process_file_path.md | 2 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 2 +- ...ndows_excessive_disabled_services_event.md | 2 +- ...ows_raw_access_to_disk_volume_partition.md | 2 +- .../2022-03-08-suspicious_msbuild_path.md | 2 +- ...t_regasm_with_no_command_line_arguments.md | 2 +- ..._regsvcs_with_no_command_line_arguments.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ...cious_dllhost_no_command_line_arguments.md | 2 +- ...ious_gpupdate_no_command_line_arguments.md | 2 +- ...ious_rundll32_no_command_line_arguments.md | 2 +- ...s_installutil_remote_network_connection.md | 2 +- ...stallutil_uninstall_option_with_network.md | 2 +- ...03-28-windows_terminating_lsass_process.md | 2 +- ...-30-windows_drivers_loaded_by_signature.md | 2 +- ...ithub_actions_disable_security_workflow.md | 2 +- ...4-windows_driver_load_non-standard_path.md | 2 +- ...4-04-windows_event_for_service_disabled.md | 2 +- ..._spring4shell_http_request_class_module.md | 2 +- .../2022-04-07-any_powershell_downloadfile.md | 2 +- ...022-04-07-any_powershell_downloadstring.md | 2 +- ...022-04-18-nltest_domain_trust_discovery.md | 2 +- ...rocesses_killed_by_industroyer2_malware.md | 2 +- ...-02-windows_krbrelayup_service_creation.md | 2 +- ...22-05-11-potential_password_in_username.md | 182 +++++++++++++ .../2022-05-16-cobalt_strike_named_pipes.md | 2 +- ...nd_scripting_interpreter_risky_commands.md | 4 +- ...rsonation_weak_encryption_simplerequest.md | 4 +- ...-splunk_identified_ssl_tls_certificates.md | 8 +- ...rsonation_weak_encryption_configuration.md | 4 +- ...tal_certificates_infrastructure_version.md | 4 +- ...digital_certificates_lack_of_encryption.md | 4 +- ...ss_injection_forwarder_bundle_downloads.md | 6 +- ...mpersonation_weak_encryption_selfsigned.md | 4 +- ..._and_scripting_interpreter_delete_usage.md | 4 +- ...nd_scripting_interpreter_risky_spl_mltk.md | 4 +- ...01-mshtml_module_load_in_office_product.md | 2 +- ...spicious_process_with_discord_dns_query.md | 2 +- ...ess_connecting_to_ip_check_web_services.md | 2 +- ...01-windows_installutil_credential_theft.md | 2 +- ...ed_remote_code_execution_cve-2022-26134.md | 2 +- ...2-06-03-excessive_usage_of_nslookup_app.md | 2 +- ...efense_delete_win_defender_context_menu.md | 170 ++++++++++++ ...se_delete_win_defender_profile_registry.md | 170 ++++++++++++ ...enses_disable_win_defender_auto_logging.md | 170 ++++++++++++ ...ws_ecr_container_scanning_findings_high.md | 174 +++++++++++++ docs/_stories/credential_dumping.md | 5 +- docs/_stories/insider_threat.md | 5 +- docs/_stories/ransomware.md | 1 + docs/_stories/spearphishing_attachments.md | 1 + .../windows_defense_evasion_tactics.md | 3 + docs/_stories/windows_registry_abuse.md | 3 + docs/mitre-map/coverage.json | 27 +- 277 files changed, 1660 insertions(+), 361 deletions(-) create mode 100644 docs/_posts/2021-08-09-rundll32_lockworkstation.md create mode 100644 docs/_posts/2022-05-11-potential_password_in_username.md create mode 100644 docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md create mode 100644 docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md create mode 100644 docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md create mode 100644 docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index beca1e0b1d..ea7d43a12a 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.43.0" + "version": "3.43.1" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 20055617d0..c307e21baa 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -5352,6 +5352,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", known_false_positives = Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Potential password in username - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt. +how_to_implement = To successfully implement this search, you need to have relevant authentication logs mapped to the Authentication data model. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The detection must run with a time interval shorter than endtime+1000. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"]} +known_false_positives = Valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating. +providing_technologies = [] + [savedsearch://ESCU - Potentially malicious code on commandline - Rule] type = detection asset_type = Endpoint @@ -6009,6 +6019,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Rundll32 LockWorkStation - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Rundll32 Process Creating Exe Dll Files - Rule] type = detection asset_type = Endpoint @@ -7415,6 +7435,36 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [ known_false_positives = False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed. providing_technologies = [] +[savedsearch://ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. +providing_technologies = [] + +[savedsearch://ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. +providing_technologies = [] + +[savedsearch://ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. +providing_technologies = [] + [savedsearch://ESCU - Windows Indirect Command Execution Via forfiles - Rule] type = detection asset_type = Endpoint @@ -9620,7 +9670,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Windows Hunting System Account Targeting Lsass - Rule", "ESCU - Windows Non-System Account Targeting Lsass - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Potential password in username - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Windows Hunting System Account Targeting Lsass - Rule", "ESCU - Windows Non-System Account Targeting Lsass - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -10073,7 +10123,7 @@ version = 1 references = ["https://www.imperva.com/learn/application-security/insider-threats/", "https://www.cisa.gov/defining-insider-threats", "https://www.code42.com/glossary/types-of-insider-threats/", "https://github.com/Insider-Threat/Insider-Threat", "https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"] +searches = ["ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Potential password in username - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"] description = Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment. narrative = Insider Threats are best defined by CISA: "Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs." An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider. @@ -10427,7 +10477,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] +searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -10569,7 +10619,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"] +searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -10587,7 +10637,7 @@ version = 1 references = ["https://www.splunk.com/en_us/product-security/announcements.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}] spec_version = 3 -searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"] +searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"] description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. @@ -10972,7 +11022,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule", "ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule", "ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -11065,7 +11115,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1112/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule", "ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule", "ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"] description = Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner. narrative = Windows Registry is one of the powerful and yet still mysterious Windows features that can tweak or manipulate Windows policies and low-level configuration settings. Because of this capability, most malware, adversaries or threat actors abuse this hierarchical database to do their malicious intent on a targeted host or network environment. In these cases, attackers often use tools to create or modify registry in ways that are not typical for most environments, providing opportunities for detection. @@ -11471,13 +11521,5 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - Rundll32 LockWorkStation - Response Task] -type = investigation -explanation = none -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - ### END RESPONSE TASKS ### \ No newline at end of file diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 9e5df9e53a..36ea55ab53 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 8305 +build = 8439 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.43.0 +version = 3.43.1 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 57d68c71fa..5f5354ff5d 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 0be9e35fe9..a4215830fa 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.43.0 +version = 3.43.1 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 3c88f0a809..3df334d530 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index b63225caef..1e2b90b132 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2097,6 +2097,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[potential_password_in_username_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [potentially_malicious_code_on_commandline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2353,6 +2357,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[rundll32_lockworkstation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [rundll32_process_creating_exe_dll_files_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2905,6 +2913,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_impair_defense_delete_win_defender_context_menu_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_impair_defense_delete_win_defender_profile_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_impair_defenses_disable_win_defender_auto_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_indirect_command_execution_via_forfiles_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3834,6 +3854,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = index=_internal sourcetype=splunkd_ui_access description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[potential_password_in_username_false_positive_reduction] +definition = search * +description = Add customer specific known false positives to the map command used in detection - Potential password in username + [potentially_malicious_code_on_cmdline_tokenize_score] definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0) description = Performs the tokenization and application of the malicious commandline classifier diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 68584dab81..dc3c8df742 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -314,7 +314,7 @@ action.escu.full_search_name = ESCU - Splunk Process Injection Forwarder Bundle action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Splunk Vulnerabilites"] +action.escu.analytic_story = ["Splunk Vulnerabilities"] action.risk = 1 action.risk.param._risk_message = $peer$ downloaded apps from $host$ action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 35}] @@ -325,7 +325,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule -action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilites"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32157", "CVE-2022-32158"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32157"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -897,8 +897,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-08-17 -action.escu.modification_date = 2021-08-17 +action.escu.creation_date = 2022-06-21 +action.escu.modification_date = 2022-06-21 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule action.escu.search_type = detection @@ -932,7 +932,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` +search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` [ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule] action.escu = 0 @@ -1012,7 +1012,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` +search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` [ESCU - AWS ECR Container Upload Outside Business Hours - Rule] action.escu = 0 @@ -22056,7 +22056,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter` +search = `sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter` [ESCU - Office Document Spawned Child Process To Download - Rule] action.escu = 0 @@ -22877,6 +22877,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter` +[ESCU - Potential password in username - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"]} +action.escu.data_models = ["Authentication"] +action.escu.eli5 = This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt. +action.escu.how_to_implement = To successfully implement this search, you need to have relevant authentication logs mapped to the Authentication data model. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The detection must run with a time interval shorter than endtime+1000. +action.escu.known_false_positives = Valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating. +action.escu.creation_date = 2022-05-11 +action.escu.modification_date = 2022-05-11 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Potential password in username - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping", "Insider Threat"] +action.risk = 1 +action.risk.param._risk_message = Potential password in username ($user$) with Shannon entropy ($ut_shannon$) +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 21}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 21}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Potential password in username - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Insider Threat"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Source:AD", "Stage:Credential Access"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" | `drop_dm_object_name(Authentication)` | lookup ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon | eval incorrect_password=user | eval endtime=endtime+1000 | map maxsearches=70 search="| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication WHERE nodename=Authentication.Successful_Authentication Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` | `potential_password_in_username_false_positive_reduction` | eval incorrect_password=\"$incorrect_password$\" | eval ut_shannon=\"$ut_shannon$\" | sort count" | where user!=incorrect_password | outlier action=RM count | `potential_password_in_username_filter` + [ESCU - Potentially malicious code on commandline - Rule] action.escu = 0 action.escu.enabled = 1 @@ -25792,6 +25832,46 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter` +[ESCU - Rundll32 LockWorkStation - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-08-09 +action.escu.modification_date = 2021-08-09 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Rundll32 LockWorkStation - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_message = process $process_name$ with cmdline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "SourceImage", "threat_object_type": "process name"}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Rundll32 LockWorkStation - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process Name"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter` + [ESCU - Rundll32 Process Creating Exe Dll Files - Rule] action.escu = 0 action.escu.enabled = 1 @@ -32040,6 +32120,126 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter` +[ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. +action.escu.known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. +action.escu.creation_date = 2022-06-07 +action.escu.modification_date = 2022-06-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"] +action.risk = 1 +action.risk.param._risk_message = Windows Defender context menu registry key deleted on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter` + +[ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. +action.escu.known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. +action.escu.creation_date = 2022-06-07 +action.escu.modification_date = 2022-06-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"] +action.risk = 1 +action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter` + +[ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. +action.escu.known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. +action.escu.creation_date = 2022-06-07 +action.escu.modification_date = 2022-06-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"] +action.risk = 1 +action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter` + [ESCU - Windows Indirect Command Execution Via forfiles - Rule] action.escu = 0 action.escu.enabled = 1 @@ -34377,7 +34577,7 @@ action.escu.full_search_name = ESCU - Winword Spawning Windows Script Host - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Spearphishing Attachment"] +action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -34388,7 +34588,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest @@ -38377,7 +38577,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter` +search = | tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter` [ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule] action.escu = 0 @@ -42433,27 +42633,6 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search http_method, "POST" | search src=$src$ -[ESCU - Rundll32 LockWorkStation - Response Task] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Rundll32 LockWorkStation - Response Task -description = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. -action.escu.creation_date = 2021-08-09 -action.escu.modification_date = 2021-08-09 -action.escu.analytic_story = ["Ransomware"] -action.escu.earliest_time_offset = 3600 -action.escu.latest_time_offset = 86400 -action.escu.providing_technologies = [] -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. -action.escu.how_to_implement = none -action.escu.known_false_positives = None at this time -disabled = true -schedule_window = auto -is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter` - ### END ESCU RESPONSE TASKS ### \ No newline at end of file diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 0d34ae2dc9..d02177ff3a 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 6e310d4fdc..c4a4d48377 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-14T13:52:57 UTC +# On Date: 2022-06-22T17:37:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 85fe88d28f..6c73973dd8 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows LOLBin Binary in Non Standard Path id: 25689101-012a-324a-94d3-08301e6c065a -version: 1 +version: 2 description: The following analytic identifies native living off the land binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io @@ -49,6 +49,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false + AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index e72b9fbb63..043d6c613a 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -571,6 +571,7 @@ sidebar: | [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Possible Browser Pass View Parameter](/endpoint/possible_browser_pass_view_parameter/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Potentially malicious code on commandline](/endpoint/potentially_malicious_code_on_commandline/) | [Windows Command Shell](/tags/#windows-command-shell) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -650,6 +651,7 @@ sidebar: | [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Rundll32 LockWorkStation](/endpoint/rundll32_lockworkstation/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -851,6 +853,9 @@ sidebar: | [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index abecdac106..8b235e458a 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -39,7 +39,7 @@ sidebar: | [Command and Control](command_and_control) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | | [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) | | [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | -| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution) | +| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [CyclopsBLink](cyclopsblink) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | | [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | @@ -68,7 +68,7 @@ sidebar: | [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | | [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [BITS Jobs](/tags/#bits-jobs) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) | -| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access), [Exfiltration](/tags/#exfiltration) | +| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Sensitive Object Access Activity](kubernetes_sensitive_object_access_activity) | None | None | @@ -97,7 +97,7 @@ sidebar: | [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) | | [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | -| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) | +| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) | | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | | [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index bb944d4ef6..c9e73bfaa9 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -94,7 +94,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be ``` -| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac +| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac | `drop_dm_object_name("Network_Sessions")` |`drop_dm_object_name("All_Sessions")` @@ -150,4 +150,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 5860da8991..351df8d65f 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,8 +95,8 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index ba87d130b6..bbb21c3187 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) > :information_source: > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index 7e2378e968..c5f5fd575e 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) > :information_source: > **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index f4a348e37c..473271fdc1 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 5604b56488..7ddc9ec68b 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 71d6f444e4..02ca8ce578 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 6fa26f2d66..3e1d527e90 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index aed242ad09..dd9f2854a8 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -100,8 +100,8 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) > :information_source: > **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 875ff5b43e..be75b3546b 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 445b0aa8ec..3de046b373 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 6228d32f4a..ade57132a5 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index 01a8bca88b..be36a668be 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index 6ce1a2e91d..f7818c9cf6 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index e89e183dd1..d877cebd94 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 9f92f7ce49..6a0338fdad 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -113,8 +113,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 7b015eb774..11c14b9a07 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -113,8 +113,8 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index ada1ed7f59..6314c7448b 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -114,8 +114,8 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 3f3ed50d37..57187c0ff4 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,8 +115,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 58dbbdc38f..e63eaaca93 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -118,9 +118,9 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index 46dae84eb1..165273c4b2 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -124,13 +124,13 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) -* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index 9a0b7389ef..499553bcaf 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -110,8 +110,8 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) > :information_source: > **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index 7706e0d302..6a92d69fb0 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 97977c0cfd..3f454963e2 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) > :information_source: > **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 9372642573..5f60fe9322 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index ca52418ecb..85c2cd05e5 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -119,8 +119,8 @@ This search detects Okta login failures due to bad credentials for multiple user #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index 6df573f907..caa4fab851 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -117,8 +117,8 @@ Detect failed Okta SSO events #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index b931e0738d..212ff4ee2b 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -118,8 +118,8 @@ This search detects logins from the same user from different cities in a 24 hour #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 7032505da1..4118197c48 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -118,8 +118,8 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) > :information_source: > **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 9b0f587725..2ba8eb08fa 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index d5664f0705..490d46bae2 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -109,8 +109,8 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) > :information_source: > **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index d979e3ae58..659299bc48 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -128,8 +128,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 8b78997c54..d6ee9b17f7 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -121,8 +121,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index 16df731e66..8b02b31f89 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -113,9 +113,9 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index c7023ed7fd..0ffc3ca3a6 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -130,8 +130,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index f4b280451b..4c082ef9f0 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -129,8 +129,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 5275e8e08a..e0ca235128 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -124,8 +124,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 5ef412da61..dc37dca253 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -110,8 +110,8 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) > :information_source: > **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index 02e4d5a45d..9aa515ac82 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -108,8 +108,8 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index c0b41eca2c..f3728f515c 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -113,8 +113,8 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 40a0588ba7..fe972a76d4 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) > :information_source: > **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index fd49f87ac7..7e4aa6a628 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index 8857789a74..ee30a723f2 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -113,8 +113,8 @@ This search detects the assignment of rights to accesss content from another mai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index 972953b60e..4037093153 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -100,8 +100,8 @@ This search detects when a user has performed an Ediscovery search or exported a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 15bbb80cd2..24a14ff406 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -114,8 +114,8 @@ This search detects when an admin configured a forwarding rule for multiple mail #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index a6fd025871..46ed9198f8 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -114,8 +114,8 @@ This search detects when multiple user configured a forwarding rule to the same #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 3fb78bf21f..c825107497 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index d264511cc0..c82dde054d 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 76b85517e1..9dd8f0fe7a 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -112,8 +112,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 80f40c2548..7c5c6ff72c 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index b7e7dfbb01..d743ca3df3 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index 27ebda9129..d5a0cd0982 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -103,8 +103,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 789547b9a3..5c5fd9416e 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -105,8 +105,8 @@ This search detects the addition of a new Federated domain. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index bf8e91a006..6c37af2788 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -113,8 +113,8 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index 67902820ae..f9cf1a3efd 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -112,8 +112,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index f790f144d3..beea6f235b 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 735dd33b8a..5a903ef10e 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index c1f594b00a..e305c8b68c 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 4f41ad6e86..d8c9000127 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 01e838de9a..63ee241b2a 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index be4d30aed2..bc208c5e86 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 082d8597ae..130f7c6dcd 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index ab18079b5d..3eca1c53ab 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 18070e75e0..620ce0a918 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index d4cf37746f..db41bf7dfa 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index b73da35928..5ac8414b89 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 20649a78c8..0b7fdfe081 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index b7495a6ba1..e492729dbd 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -103,8 +103,8 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 5583fced4f..69da9eb447 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 9484c6a320..f0359f53c9 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -107,8 +107,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index ebd16db17c..ab261f4d7d 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index a7a8420e93..20d0073cd2 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 89a771922f..501c9660d5 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index e7b23e671b..1b841987af 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -130,7 +130,7 @@ To successfully implement this search you need to be ingesting information on pr There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. #### Associated Analytic story -* [Spearphishing Attachment](/stories/spearphishing_attachment) +* [Spearphishing Attachments](/stories/spearphishing_attachments) diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 395cc1b89a..75a6897250 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index bef8758516..56c059af2a 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index eeb3ab4fee..e3e263aa54 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -97,7 +97,7 @@ this detection was designed to identifies suspicious office documents that using #### Search ``` -`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") +`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 000c69e486..85a2c57319 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index caf4fa1b8e..a3a7e05749 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 42583c9bdf..4cdbd433e0 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index ec93fceb92..f787b8f414 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index c40ab2bb31..e0ae691ef6 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 8b9810d35a..2f4662d6e8 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index fb37b43389..cd8bc91dff 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 83ac9784e0..50ceecec7c 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index aee81a0e17..a6c6750967 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index e1e4038175..23dc5d2084 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index cc29fc4eab..895a6c51d5 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index ff1e142ac3..43c3a38d63 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 7046351428..aea92238c8 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index bc7dfa7f87..2d513333bd 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -102,9 +102,9 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 535a631c2c..5d3c6378ba 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -102,9 +102,9 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index 7e62bef14e..3dec5b2e36 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -103,9 +103,9 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 43eaa37a0b..e75d99cd23 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 9cbb027826..2b90be4869 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -103,9 +103,9 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 64ff8b9995..869bea7299 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 1ed5f0e08d..c32f863108 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index bb4baa84c7..5286c0105c 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index aa6d560171..f095875738 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index e87879902a..3c01acc3b9 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index 72713207b3..d2bde70c61 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index a11edd86b5..eb65981ea1 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index 8c3d97cd67..bfc3e0d66e 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -107,8 +107,8 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index 901c9a4e51..f6419290a6 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -107,8 +107,8 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 849bccd29b..f3fa23324d 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index 2ce03df914..a0f829606a 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 081961e406..d5094a4a8e 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 1972abccfb..57fa4e8b70 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -114,8 +114,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index bbc1985d5b..c3db511f1e 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index a22067412c..406084fcfc 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 72cefff943..20678262d5 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index 324bc9edb8..b7f5ee265e 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index c9f070f3ec..6f9d39c5bf 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 18015756a1..251e2c5e25 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -107,10 +107,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 1038195192..1a8abd0c7d 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index 7ee60a9e83..ef3e261bdf 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 2fee621286..2612bc03e8 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index e574e6f691..fa9fa4b335 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 2c4448604c..14846a2e0e 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index 27cbb5c585..a70a85e8c3 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -109,8 +109,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index fdf4ec8c06..57dd88fc58 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 35acb6bef9..229fecc735 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 7ee2b55ee4..1f2de9c0c4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index ae7b48391d..d478b8a1dc 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index e3ec1efb85..24da952f26 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index bf0db94672..2d8501f31d 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-09-rundll32_lockworkstation.md b/docs/_posts/2021-08-09-rundll32_lockworkstation.md new file mode 100644 index 0000000000..5058d1066c --- /dev/null +++ b/docs/_posts/2021-08-09-rundll32_lockworkstation.md @@ -0,0 +1,165 @@ +--- +title: "Rundll32 LockWorkStation" +excerpt: "System Binary Proxy Execution +, Rundll32 +" +categories: + - Endpoint +last_modified_at: 2021-08-09 +toc: true +toc_label: "" +tags: + - System Binary Proxy Execution + - Rundll32 + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-08-09 +- **Author**: Teoderick Contreras, Splunk +- **ID**: fa90f372-f91d-11eb-816c-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | + +| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `rundll32_lockworkstation_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **rundll32_lockworkstation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process +* Processes.parent_process_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | process $process_name$ with cmdline $process$ in host $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rundll32_lockworkstation.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 65a9387f53..3fb4417f2a 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index 3c41a25ed8..9503d402ab 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -107,8 +107,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 627b13cfc4..096fcc5bea 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -111,7 +111,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" -| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index a5d581a73a..c869495b9b 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -112,8 +112,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index fcb09a3843..119d3124c1 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -107,8 +107,8 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index c53734cb79..cc02548366 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) > :information_source: > **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index dee1311390..6aefa7a7eb 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -110,8 +110,8 @@ This search is to detect a gsuite email contains suspicious subject having known #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index 0db42eec42..b176886222 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index d467a3d42a..ac0fc91be6 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index b9eae53195..97395a0a7b 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -110,8 +110,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index d62060e513..ab149bc49c 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index ed38bcefb7..68b6e25aab 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index a4109f88e7..27495bc909 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) > :information_source: > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index e2886e38e9..2eef99dca3 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index 8e071247fe..fd2a212384 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 5472ee8db6..986599f6e5 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 5f1e7fe3f7..64cb7c7e3c 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 134b9a1a46..a6cbdb54f1 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -112,8 +112,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index 9e7b8b4572..d74d500fcd 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -112,8 +112,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 3b0d396361..397b2fde50 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index d0dc7976de..9b34319ea7 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index 7eede94a27..aebb4338a1 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -108,9 +108,9 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 54672494fe..fb65fae26a 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -117,8 +117,8 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 03592ce7d2..43ce2e7a48 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,9 +113,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 1de2af652c..2973716561 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -103,9 +103,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index d2c8c7bf2d..1719e88830 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -108,9 +108,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 7b9f556da7..abb3e468f1 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,10 +112,10 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index f6f060195b..dcf5dcfcc6 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index d6a564ecf3..07f3c1ee10 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index a314652ee7..2b0c206d92 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) > :information_source: > **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index f7fe599fd1..7adebd9f38 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) > :information_source: > **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 778d8b6ff4..917308ab5f 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -113,8 +113,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 7ec5743895..6d3b9fd3f3 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -113,8 +113,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 792de3fc4f..ffec5424f8 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -113,8 +113,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) > :information_source: > **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 71034b077f..cbd7f74e6d 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -115,8 +115,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index b1aa6cdf31..f4b3227e0b 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) > :information_source: > **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 0969ffa570..25121ac6e9 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -112,8 +112,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index be4fd3f7ba..5ed0df7318 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -108,8 +108,8 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 26d9c2b9b0..324b00134c 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -107,9 +107,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 9014907709..9a0aea5cea 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -109,8 +109,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index a3863a8678..f51ec23ad7 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -102,8 +102,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index e139502ae5..2de92d79aa 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -108,8 +108,8 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) > :information_source: > **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 28feffa6ea..14fed43740 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -109,9 +109,9 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: +* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) > :information_source: > **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 4320088985..0285716fab 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -104,9 +104,9 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: -* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) > :information_source: > **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index 1aa535fe1c..ab3efa98b0 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -106,9 +106,9 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: -* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) > :information_source: > **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 971dd3bbde..1f87ace6f7 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -108,8 +108,8 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index 8a8ef5efad..44ab86c0bc 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -109,8 +109,8 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 1eb00cabc5..215c786252 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,9 +111,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index 528f6b0294..dfc676e66c 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,9 +110,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 37b92ca050..73a0c311f5 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index 133e5e5ae1..f50a85740c 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index d611b7f432..458e515aef 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index ab844da06b..1c834b88c8 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 8a5c2e0826..7616892f0b 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -102,8 +102,8 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index b547469c0b..44e6b12703 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index ddf621fad7..1c40def6e4 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index 625fff80eb..c91245a56f 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -102,8 +102,8 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index d94c2cff62..180db1a279 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 9c3749457a..a36466edd5 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -108,8 +108,8 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) > :information_source: > **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 4a076c35c3..130435c879 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -109,9 +109,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) > :information_source: > **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index a7e3a6be4d..5b55936c2f 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 58ff38a98a..ee9b513261 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index c48ad067c4..cc2eb7766c 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 70436ece37..65de741ab3 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index f58ff3f639..383cc57008 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index b4a40a14d5..02fb93e350 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 12c713a123..d77807e154 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -119,8 +119,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 921bf0c555..58e4d0e11d 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,9 +117,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index f0282edf5f..837ffae589 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index 548baa0f37..24d910afbf 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -115,9 +115,9 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: +* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) > :information_source: > **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index e89c702ca3..7799ba7e41 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index d092e269dc..b0dc4c81af 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -103,8 +103,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index b4a4ddd812..9d1509047e 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -103,8 +103,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md index af277a65bb..675f3abf1c 100644 --- a/docs/_posts/2022-02-03-o365_added_service_principal.md +++ b/docs/_posts/2022-02-03-o365_added_service_principal.md @@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md index 250614bfde..861cd2db17 100644 --- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md @@ -110,8 +110,8 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md index 7dc316494e..c8571f10e9 100644 --- a/docs/_posts/2022-02-03-o365_disable_mfa.md +++ b/docs/_posts/2022-02-03-o365_disable_mfa.md @@ -102,8 +102,8 @@ This search detects when multi factor authentication has been disabled, what ent #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index df18dc6ceb..7e85cb86f9 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index e5645065c1..250e164d6a 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -103,9 +103,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) > :information_source: > **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index be25d49dfa..7722585244 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -111,8 +111,8 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 64239bc1a7..1ca1e1d4f7 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index 39f2b80d72..12bd46fc7a 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 51d1e73d56..b8e76acd2d 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 663285a202..6c6367c37c 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md index 37dfa77e2e..9552bd6766 100644 --- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md @@ -101,8 +101,8 @@ This search detects when an excessive number of authentication failures occur th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index fe11db54f8..d2e44a1965 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index 75b9319c65..d2f3c5bda6 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 46b18ec802..0fa7e197b5 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 8585a4f9e0..539abbfa7f 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index cdc1d04670..dc2e9a91c9 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -122,9 +122,9 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index 166aa0dead..b442efd626 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -114,8 +114,8 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) > :information_source: > **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index a4972826ff..2a33a397b7 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index 61890d3fea..4c780c3d97 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index e9b550679a..c5fb8b3ffa 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -105,8 +105,8 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) > :information_source: > **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index 8b4e61d37a..f1df36b2c2 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 1124eaa96f..3805e9254b 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index 02546a0eed..a695f6e7b7 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,9 +115,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 4eba7529a2..e7ffbdeb55 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,9 +116,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 424eff1d3a..42ee8d7ce7 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index f5be1cf051..c503983391 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index cb85c01f90..008e97ef0a 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index e8bf097fdc..a49622fd78 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -107,8 +107,8 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index 5d7224b035..ba8933f81a 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index aa65234c4a..d73eeffe74 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -113,8 +113,8 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index 329d185ff5..65e39d055c 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index 4ed02b76f5..d7ba5d5cc3 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 4502ff62f6..7192ee4b40 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -108,8 +108,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index b10e220124..7249744d4d 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 197ec18a1a..50bd382f02 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-11-potential_password_in_username.md b/docs/_posts/2022-05-11-potential_password_in_username.md new file mode 100644 index 0000000000..1cc277a682 --- /dev/null +++ b/docs/_posts/2022-05-11-potential_password_in_username.md @@ -0,0 +1,182 @@ +--- +title: "Potential password in username" +excerpt: "Local Accounts +, Credentials In Files +" +categories: + - Endpoint +last_modified_at: 2022-05-11 +toc: true +toc_label: "" +tags: + - Local Accounts + - Credentials In Files + - Defense Evasion + - Initial Access + - Persistence + - Privilege Escalation + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Authentication +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This search identifies users who have entered their passwords in username fields. This is done by looking for failed authentication attempts using usernames with a length longer than 7 characters and a high Shannon entropy, and looks for the next successful authentication attempt from the same source system to the same destination system as the failed attempt. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) +- **Last Updated**: 2022-05-11 +- **Author**: Mikael Bjerkeland, Splunk +- **ID**: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | + +| [T1552.001](https://attack.mitre.org/techniques/T1552/001/) | Credentials In Files | Credential Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Reconnaissance + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" +| `drop_dm_object_name(Authentication)` +| lookup ut_shannon_lookup word AS user +| where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 +| sort count, - ut_shannon +| eval incorrect_password=user +| eval endtime=endtime+1000 +| map maxsearches=70 search=" +| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication WHERE nodename=Authentication.Successful_Authentication Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" +| `drop_dm_object_name(\"Authentication\")` +| `potential_password_in_username_false_positive_reduction` +| eval incorrect_password=\"$incorrect_password$\" +| eval ut_shannon=\"$ut_shannon$\" +| sort count" +| where user!=incorrect_password +| outlier action=RM count +| `potential_password_in_username_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [potential_password_in_username_false_positive_reduction](https://github.com/splunk/security_content/blob/develop/macros/potential_password_in_username_false_positive_reduction.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **potential_password_in_username_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* Authentication.user +* Authentication.src +* Authentication.dest +* sourcetype + + +#### How To Implement +To successfully implement this search, you need to have relevant authentication logs mapped to the Authentication data model. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The detection must run with a time interval shorter than endtime+1000. + +#### Known False Positives +Valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating. + +#### Associated Analytic story +* [Credential Dumping](/stories/credential_dumping) +* [Insider Threat](/stories/insider_threat) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 21.0 | 30 | 70 | Potential password in username ($user$) with Shannon entropy ($ut_shannon$) | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://medium.com/@markmotig/search-for-passwords-accidentally-typed-into-the-username-field-975f1a389928](https://medium.com/@markmotig/search-for-passwords-accidentally-typed-into-the-username-field-975f1a389928) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/password_in_username/linux_secure.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/password_in_username/linux_secure.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/potential_password_in_username.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index 484b31b7fd..562a6beea7 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md index a4e1df1b24..b15cf016bd 100644 --- a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md +++ b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32154 - Splunk_Audit --- @@ -93,7 +93,7 @@ The Splunk platform contains built-in search processing language (SPL) safeguard
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32154](https://nvd.nist.gov/vuln/detail/CVE-2022-32154) | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will. | None | diff --git a/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md b/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md index 2592448e3b..473cb379cb 100644 --- a/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md +++ b/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32152 --- @@ -92,7 +92,7 @@ On Splunk version 9 on Python3 client libraries verify server certificates by de
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32152](https://nvd.nist.gov/vuln/detail/CVE-2022-32152) | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | diff --git a/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md b/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md index 6a235a7499..6fc1f15216 100644 --- a/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md +++ b/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md @@ -14,8 +14,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - - - + - CVE-2022-32151 + - CVE-2022-32152 --- @@ -94,8 +94,8 @@ The following analytic uses tags of SSL, TLS and certificate to identify the usa
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32151](https://nvd.nist.gov/vuln/detail/CVE-2022-32151) | The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | +| [CVE-2022-32152](https://nvd.nist.gov/vuln/detail/CVE-2022-32152) | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | diff --git a/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md b/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md index 45bacf61e1..e62aa4efc2 100644 --- a/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md +++ b/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32151 --- @@ -92,7 +92,7 @@ On June 14th, 2022, Splunk released a security advisory relating to TLS validati
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32151](https://nvd.nist.gov/vuln/detail/CVE-2022-32151) | The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | diff --git a/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md b/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md index f983cabd38..857f9d725a 100644 --- a/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md +++ b/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32153 --- @@ -92,7 +92,7 @@ This search will check the TLS validation is properly configured on the search h
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32153](https://nvd.nist.gov/vuln/detail/CVE-2022-32153) | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | diff --git a/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md b/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md index cd8a5b7f2b..357fe03ed7 100644 --- a/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md +++ b/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32151 --- @@ -92,7 +92,7 @@ On June 14th, 2022, Splunk released a security advisory relating to the authenti
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32151](https://nvd.nist.gov/vuln/detail/CVE-2022-32151) | The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | diff --git a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md index 7476b0ef44..908e4e5892 100644 --- a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md +++ b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md @@ -14,8 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - - - + - CVE-2022-32157 --- @@ -94,8 +93,7 @@ On June 14th, 2022, Splunk released a security advisory relating to the authenti
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32157](https://nvd.nist.gov/vuln/detail/CVE-2022-32157) | Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation. | None | diff --git a/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md b/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md index 88cca6ad70..9daf2c5338 100644 --- a/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md +++ b/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32152 --- @@ -92,7 +92,7 @@ On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS v
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32152](https://nvd.nist.gov/vuln/detail/CVE-2022-32152) | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. | None | diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md index 1f47edb329..dbf85e9f4d 100644 --- a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md +++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32154 - Splunk_Audit --- @@ -93,7 +93,7 @@ The following analytic identifies the use of the risky command - Delete - that m
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32154](https://nvd.nist.gov/vuln/detail/CVE-2022-32154) | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will. | None | diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md index e6e8cc21a6..009c6a2753 100644 --- a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md +++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md @@ -13,7 +13,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-32154 - Splunk_Audit --- @@ -92,7 +92,7 @@ This detection utilizes machine learning model named "risky_command_abuse" train
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-32154](https://nvd.nist.gov/vuln/detail/CVE-2022-32154) | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will. | None | diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md index b18ce4fe3e..174eac3cf3 100644 --- a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md @@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md index d62428fbc2..a841bd35e8 100644 --- a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md @@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md index cdc455112a..8cc453ba00 100644 --- a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md @@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md index 41f5193809..08612d4668 100644 --- a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md +++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md @@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md b/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md index de3e2d1ab2..8efa8efaee 100644 --- a/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md +++ b/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md @@ -98,7 +98,7 @@ The following analytic assists with identifying CVE-2022-26134 based exploitatio
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2022-26134](https://nvd.nist.gov/vuln/detail/CVE-2022-26134) | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. | None | +| [CVE-2022-26134](https://nvd.nist.gov/vuln/detail/CVE-2022-26134) | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. | 7.5 | diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md index 93e889596e..0acdbed77f 100644 --- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md @@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md new file mode 100644 index 0000000000..055066a576 --- /dev/null +++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md @@ -0,0 +1,170 @@ +--- +title: "Windows Impair Defense Delete Win Defender Context Menu" +excerpt: "Disable or Modify Tools +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-06-07 +toc: true +toc_label: "" +tags: + - Disable or Modify Tools + - Impair Defenses + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The search looks for the deletion of Windows Defender context menu within the registry. This is consistent behavior with RAT malware across a fleet of endpoints. This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-06-07 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 395ed5fe-ad13-4366-9405-a228427bdd91 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Delivery + + +
+
+ + +
+ NIST + +
+ +* PR.PT +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 8 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_impair_defense_delete_win_defender_context_menu_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **windows_impair_defense_delete_win_defender_context_menu_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.action + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. + +#### Known False Positives +It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Windows Registry Abuse](/stories/windows_registry_abuse) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | Windows Defender context menu registry key deleted on $dest$. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) +* [https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/](https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md new file mode 100644 index 0000000000..13f5c42b38 --- /dev/null +++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md @@ -0,0 +1,170 @@ +--- +title: "Windows Impair Defense Delete Win Defender Profile Registry" +excerpt: "Disable or Modify Tools +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-06-07 +toc: true +toc_label: "" +tags: + - Disable or Modify Tools + - Impair Defenses + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-06-07 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 65d4b105-ec52-48ec-ac46-289d0fbf7d96 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Delivery + + +
+
+ + +
+ NIST + +
+ +* PR.PT +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 8 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_impair_defense_delete_win_defender_profile_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **windows_impair_defense_delete_win_defender_profile_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.action + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. + +#### Known False Positives +It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Windows Registry Abuse](/stories/windows_registry_abuse) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | Windows Defender Logger registry key set to 'disabled' on $dest$. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) +* [https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/](https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md new file mode 100644 index 0000000000..1dc2c0cb10 --- /dev/null +++ b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md @@ -0,0 +1,170 @@ +--- +title: "Windows Impair Defenses Disable Win Defender Auto Logging" +excerpt: "Disable or Modify Tools +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-06-07 +toc: true +toc_label: "" +tags: + - Disable or Modify Tools + - Impair Defenses + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-06-07 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Delivery + + +
+
+ + +
+ NIST + +
+ +* PR.PT +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 8 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_impair_defenses_disable_win_defender_auto_logging_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **windows_impair_defenses_disable_win_defender_auto_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.action + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. + +#### Known False Positives +It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Windows Registry Abuse](/stories/windows_registry_abuse) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 24.0 | 30 | 80 | Windows Defender Logger registry key set to 'disabled' on $dest$. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) +* [https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/](https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md new file mode 100644 index 0000000000..68334536f8 --- /dev/null +++ b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md @@ -0,0 +1,174 @@ +--- +title: "AWS ECR Container Scanning Findings High" +excerpt: "Malicious Image +, User Execution +" +categories: + - Cloud +last_modified_at: 2022-06-21 +toc: true +toc_label: "" +tags: + - Malicious Image + - User Execution + - Execution + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-06-21 +- **Author**: Patrick Bareiss, Splunk +- **ID**: 62721bd2-1d82-4623-b6e6-aac170014423 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* PR.DS +* PR.AC +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 13 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity=HIGH +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image +| eval finding = finding_name.", ".finding_description +| eval phase="release" +| eval severity="high" +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_high_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) + +> :information_source: +> **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* eventSource +* eventName +* responseElements.imageScanFindings.findings{} +* awsRegion +* requestParameters.imageId.imageDigest +* requestParameters.repositoryName +* user +* userName +* src_ip + + +#### How To Implement +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Dev Sec Ops](/stories/dev_sec_ops) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 70 | 100 | Vulnerabilities with severity high found in image $image$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index 6c33f6adf1..6061c3fe08 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -7,10 +7,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - Authentication - Endpoint - Actions on Objectives - Exploitation - Installation + - Reconnaissance --- [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -20,7 +22,7 @@ tags: Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication), [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - **Last Updated**: 2020-02-04 - **Author**: Rico Valdez, Splunk - **ID**: 854d78bf-d0e2-4f4e-b05c-640905f86d7a @@ -54,6 +56,7 @@ The detection searches in this Analytic Story monitor access to the Local Securi | [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting | | [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | | [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | +| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files)| Hunting | | [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting | | [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | diff --git a/docs/_stories/insider_threat.md b/docs/_stories/insider_threat.md index 172fea6b8f..4ee44b4807 100644 --- a/docs/_stories/insider_threat.md +++ b/docs/_stories/insider_threat.md @@ -8,8 +8,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Splunk Behavioral Analytics + - Authentication - Endpoint - Exploitation + - Reconnaissance --- [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -19,7 +21,7 @@ tags: Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Splunk Behavioral Analytics -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication), [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - **Last Updated**: 2022-05-19 - **Author**: Jose Hernandez, Splunk - **ID**: c633df29-a950-4c4c-a0f8-02be6730797c @@ -36,6 +38,7 @@ Insider Threats are best defined by CISA: "Insider threat incidents are possible | [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account)| Anomaly | | [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | +| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files)| Hunting | | [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | #### Reference diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md index 5f9dbd9469..6980ae4bf9 100644 --- a/docs/_stories/ransomware.md +++ b/docs/_stories/ransomware.md @@ -78,6 +78,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP | | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution)| TTP | | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry)| TTP | +| [Rundll32 LockWorkStation](/endpoint/rundll32_lockworkstation/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Anomaly | | [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs)| TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | diff --git a/docs/_stories/spearphishing_attachments.md b/docs/_stories/spearphishing_attachments.md index 0e17c33da9..a3e95a82cb 100644 --- a/docs/_stories/spearphishing_attachments.md +++ b/docs/_stories/spearphishing_attachments.md @@ -60,6 +60,7 @@ This Analytic Story focuses on detecting signs that a malicious payload has been | [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | +| [Winword Spawning Windows Script Host](/endpoint/winword_spawning_windows_script_host/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Gdrive suspicious file sharing](/cloud/gdrive_suspicious_file_sharing/) | [Phishing](/tags/#phishing)| Hunting | | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing)| Hunting | | [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index b396c3b240..c9cdd4b3f0 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -77,6 +77,9 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting | | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting | +| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly | +| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP | | [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection)| Anomaly | | [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Process Injection](/tags/#process-injection)| TTP | diff --git a/docs/_stories/windows_registry_abuse.md b/docs/_stories/windows_registry_abuse.md index 26ee941b36..ba064f4e83 100644 --- a/docs/_stories/windows_registry_abuse.md +++ b/docs/_stories/windows_registry_abuse.md @@ -86,6 +86,9 @@ Windows Registry is one of the powerful and yet still mysterious Windows feature | [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting | +| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly | +| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP | | [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls)| TTP | | [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses)| TTP | diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 6512d1e53b..30eb69a7a6 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -116,8 +116,8 @@ }, { "techniqueID": "T1562", - "score": 50, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml" + "score": 53, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml" }, { "techniqueID": "T1554", @@ -281,8 +281,8 @@ }, { "techniqueID": "T1218", - "score": 53, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml" + "score": 54, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml" }, { "techniqueID": "T1036", @@ -291,8 +291,8 @@ }, { "techniqueID": "T1218.011", - "score": 15, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml" + "score": 16, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml" }, { "techniqueID": "T1204.002", @@ -346,8 +346,8 @@ }, { "techniqueID": "T1562.001", - "score": 39, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml" }, { "techniqueID": "T1021.001", @@ -521,8 +521,8 @@ }, { "techniqueID": "T1078.003", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/potential_password_in_username.yml" }, { "techniqueID": "T1505", @@ -879,6 +879,11 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ping_sleep_batch_command.yml" }, + { + "techniqueID": "T1552.001", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/potential_password_in_username.yml" + }, { "techniqueID": "T1027.005", "score": 2, @@ -1132,7 +1137,7 @@ "#096ed7" ], "minValue": 0, - "maxValue": 53 + "maxValue": 54 }, "filters": { "platforms": [ From 056b07a686e8f86e1931d7f699e291539057f5c7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 23 Jun 2022 11:09:07 -0600 Subject: [PATCH 114/114] remove detection --- ...ws_msiexec_load_from_non_standard_path.yml | 81 ------------------- ...iexec_load_from_non_standard_path.test.yml | 13 --- 2 files changed, 94 deletions(-) delete mode 100644 detections/endpoint/windows_msiexec_load_from_non_standard_path.yml delete mode 100644 tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml diff --git a/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml b/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml deleted file mode 100644 index 48f9e0e66a..0000000000 --- a/detections/endpoint/windows_msiexec_load_from_non_standard_path.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Windows MSIExec Load from Non-Standard Path -id: 42bb73c8-302c-45ce-9e87-2e81c2107725 -version: 1 -date: '2022-06-16' -author: Michael Haag, Splunk -type: TTP -datamodel: -- Endpoint -description: The following analytic identifies msiexec.exe running from a non-standard location. This is a commonly used method by adversaries to evade detection logic. - During triage, capture any file modification artifacts and review parallel processes. -search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` NOT (Processes.process_path IN ("*system32*","*syswow64*","*winsxs*")) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process_path - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_msiexec_load_from_non_standard_path_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present as some legitimate applications may use a moved or renamed instance of MSIExec. Filter as needed. -references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 70 - context: - - Source:Endpoint - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-security.log - impact: 70 - kill_chain_phases: - - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to run from a non-standard path. - mitre_attack_id: - - T1218.007 - nist: - - DE.CM - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 49 - security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml b/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml deleted file mode 100644 index 7a3b9dba3e..0000000000 --- a/tests/endpoint/windows_msiexec_load_from_non_standard_path.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows MSIExec Load from Non-Standard Path Unit Test -tests: -- name: Windows MSIExec Load from Non-Standard Path - file: endpoint/windows_msiexec_load_from_non_standard_path.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: msiexec_moved.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/msiexec_moved.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true