mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mhaag-spl
c21877ceb8
## Updated Analytics Attempt To Delete Services Attempt To Disable Services Attempted Credential Dump From Registry via Reg exe Delete a net user Deny Permission using Cacls Utility Detect Dump LSASS Memory using comsvcs Disable Net User Account First time seen command line argument Grant Permission Using Cacls Utility Prohibited apps spawning cmdprompt Potential Pass the Token or Hash Observed at the Destination Device Rare Parent-Child Process Relationship ptt pth kerb ntlm origin device Resize Shadowstorage Volume sdelete application execution ## Deprecated BA Analytics ssa___applying_stolen_credentials_via_mimikatz_modules.yml ssa___applying_stolen_credentials_via_powersploit_modules.yml ssa___assess_credential_strength_via_dsinternals_modules.yml ssa___credential_extraction_dsinternals_conversion_modules.yml Ssa___credential_extraction_dsinternals_modules.yml Ssa___credential_extraction_getaddbaccount_from_dump.yml Ssa___credential_extraction_powersploit_modules.yml ssa___illegal_access_user_content_via_powersploit_modules.yml ssa___illegal_account_creation_via_powersploit_modules.yml ssa___illegal_account_enable_disable_via_dsinternals_modules.yml ssa___illegal_log_deletion_via_mimikatz_modules.yml ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml Ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml ssa___illegal_privilege_elevation_via_mimikatz_modules.yml ssa___illegal_service_and_process_control_via_mimikatz_modules.yml ssa___illegal_service_and_process_control_via_powersploit_modules.yml Ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml ssa___recon_and_use_computers_domains_via_powersploit_modules.yml ssa___recon_and_use_computers_via_mimikatz_modules.yml ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml ssa___recon_and_use_shares_via_mimikatz_modules.yml ssa___recon_and_use_shares_via_powersploit_modules.yml Ssa___recon_connectivity_via_powersploit_modules.yml ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml ssa___recon_defensive_tools_via_powersploit_modules.yml ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml ssa___recon_process_service_hijacking_via_mimikatz_modules.yml ssa___recon_processes_and_services_via_mimikatz_modules.yml ssa___setting_credentials_via_dsinternals_modules.yml ssa___setting_credentials_via_mimikatz_modules.yml ssa___setting_credentials_via_powersploit_modules.yml ssa___credential_extraction_fgdump_cachedump_s_option.yml Ssa___credential_extraction_fgdump_cachedump_v_option.yml ssa___credential_extraction_ms_debuggers_kernel_peek.yml ssa___credential_extraction_ms_debuggers_z_option.yml Ssa___credential_extraction_lazagne_command_options.yml
83 lines
3.0 KiB
YAML
83 lines
3.0 KiB
YAML
name: Credential Extraction indicative of use of PowerSploit modules
|
|
id: 5f1186a4-e681-446e-851c-dc9574ad28eb
|
|
version: 1
|
|
date: '2020-10-21'
|
|
author: Stanislav Miskovic, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint_Processes
|
|
description: Credential extraction is often an illegal recovery of credential material
|
|
from secured authentication resources and repositories. This process may also involve
|
|
decryption or other transformations of the stored credential material. PowerSploit
|
|
is a collection of Microsoft PowerShell modules commonly employed in exploits.
|
|
search: '| from read_ssa_enriched_events()
|
|
|
|
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
|
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
|
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
|
/(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
|
|
OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
|
|
)
|
|
|
|
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
|
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
|
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
|
| into write_ssa_detected_events();'
|
|
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
|
including the event ID 4688 with enabled command line logging.
|
|
known_false_positives: None identified.
|
|
references:
|
|
- https://github.com/PowerShellMafia/PowerSploit
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
- Malicious PowerShell
|
|
asset_type: Windows
|
|
cis20:
|
|
- CIS 16
|
|
confidence: 100
|
|
context:
|
|
- Source:AD
|
|
- Source:Endpoint
|
|
- Stage:Credential Access
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: PowerSploit malware is extracting encoded credentials or spoofing automated
|
|
logings. Operation is performed at the device $dest_device_id$, by the account
|
|
$dest_user_id$ via command $cmd_line$
|
|
mitre_attack_id:
|
|
- T1003
|
|
nist:
|
|
- PR.AC
|
|
- PR.IP
|
|
observable:
|
|
- name: dest_user_id
|
|
type: User
|
|
role:
|
|
- Actor
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: cmd_line
|
|
type: processname
|
|
role:
|
|
- Others
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- dest_device_id
|
|
- dest_user_id
|
|
- process
|
|
- _time
|
|
risk_score: 70
|
|
risk_severity: high
|
|
security_domain: endpoint
|