mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
97 lines
3.8 KiB
YAML
97 lines
3.8 KiB
YAML
name: Credential Extraction indicative of use of DSInternals modules
|
|
id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
|
|
version: 2
|
|
date: '2021-11-29'
|
|
author: Stanislav Miskovic, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint_Processes
|
|
description: The following analytic identifies modules of DSInternals being used on
|
|
the associated endpoint. Adversaries may use these modules for manipulating data
|
|
related to Active Directory and credentials.
|
|
search: '| from read_ssa_enriched_events()
|
|
|
|
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
|
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
|
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
|
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
|
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
|
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-SamPasswordPolicy/)=true )
|
|
|
|
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
|
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
|
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
|
process_name]) | into write_ssa_detected_events();'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name, parent process, and command-line executions from your
|
|
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
|
Sysmon TA.
|
|
known_false_positives: None identified as this is strictly identifying known command-line
|
|
attributes related to DSInternals.
|
|
references:
|
|
- https://github.com/MichaelGrafnetter/DSInternals
|
|
- https://attack.mitre.org/techniques/T1059/001/
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
- Malicious PowerShell
|
|
asset_type: Windows
|
|
cis20:
|
|
- CIS 16
|
|
confidence: 100
|
|
context:
|
|
- Source:AD
|
|
- Source:Endpoint
|
|
- Stage:Credential Access
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: DSInternals tool kit is accessing sensitive credential material such as
|
|
KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
|
|
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
|
via process $process_name$
|
|
mitre_attack_id:
|
|
- T1003
|
|
- T1003.002
|
|
- T1059.001
|
|
nist:
|
|
- PR.AC
|
|
- PR.IP
|
|
observable:
|
|
- name: dest_user_id
|
|
type: User
|
|
role:
|
|
- Actor
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- dest_device_id
|
|
- process_name
|
|
- parent_process_name
|
|
- _time
|
|
- process_path
|
|
- dest_user_id
|
|
- process
|
|
- cmd_line
|
|
risk_score: 70
|
|
risk_severity: high
|
|
security_domain: endpoint
|