mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Jose Enrique Hernandez
83 lines
3.0 KiB
YAML
83 lines
3.0 KiB
YAML
name: Credential Extraction indicative of use of PowerSploit modules
|
|
id: 5f1186a4-e681-446e-851c-dc9574ad28eb
|
|
version: 1
|
|
date: '2020-10-21'
|
|
author: Stanislav Miskovic, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint_Processes
|
|
description: Credential extraction is often an illegal recovery of credential material
|
|
from secured authentication resources and repositories. This process may also involve
|
|
decryption or other transformations of the stored credential material. PowerSploit
|
|
is a collection of Microsoft PowerShell modules commonly employed in exploits.
|
|
search: '| from read_ssa_enriched_events()
|
|
|
|
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
|
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
|
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
|
/(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
|
|
OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
|
|
OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
|
|
/(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
|
|
)
|
|
|
|
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
|
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
|
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
|
| into write_ssa_detected_events();'
|
|
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
|
including the event ID 4688 with enabled command line logging.
|
|
known_false_positives: None identified.
|
|
references:
|
|
- https://github.com/PowerShellMafia/PowerSploit
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
- Malicious PowerShell
|
|
asset_type: Windows
|
|
cis20:
|
|
- CIS 16
|
|
confidence: 100
|
|
context:
|
|
- Source:AD
|
|
- Source:Endpoint
|
|
- Stage:Credential Access
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: PowerSploit malware is extracting encoded credentials or spoofing automated
|
|
logings. Operation is performed at the device $dest_device_id$, by the account
|
|
$dest_user_id$ via command $cmd_line$
|
|
mitre_attack_id:
|
|
- T1003
|
|
nist:
|
|
- PR.AC
|
|
- PR.IP
|
|
observable:
|
|
- name: dest_user_id
|
|
type: User
|
|
role:
|
|
- Actor
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: cmd_line
|
|
type: processname
|
|
role:
|
|
- Others
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- dest_device_id
|
|
- dest_user_id
|
|
- process
|
|
- _time
|
|
risk_score: 70
|
|
risk_severity: high
|
|
security_domain: endpoint
|