splunk-security_content/summary.yml

summary:
  success: false
  total_detections: 11
  total_pass: 8
  total_fail: 3
  total_skipped: 0
  total_untested: 0
  total_experimental_or_deprecated: 0
  success_rate: 72.7%
tested_detections:
- name: Windows AD Replication Request Initiated from Unsanctioned Location
  search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
    "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*",
    "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
    AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
    OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") | stats min(_time)
    as attack_time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID,
    ObjectName, ObjectServer, ObjectType, OperationType, status | rename SubjectDomainName
    as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId | appendpipe
    [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
    | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid,
    Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName,
    ObjectServer, ObjectType, OperationType | stats min(attack_time) as _time, values(TargetUserSid)
    as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
    values(Computer) as Computer, values(status) as status, values(src_category) as
    src_category, values(src_ip) as src_ip by TargetLogonId | search NOT src_category="domain_controller"
    | `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`'
  success: false
  tests:
  - name: True Positive Test
    test_type: unit
    success: false
    message: TEST ERROR
    exception: The observable field(s) {'src_ip'} are missing in the detection results
    status: error
    duration: 6.49
    wait_duration: null
    resultCount: '1'
    runDuration: '1.320'
  - name: True Positive Test
    test_type: integration
    success: false
    message: 'TEST FAILED (PREEMPTIVE): associated unit test failed or encountered
      an error'
    exception: The observable field(s) {'src_ip'} are missing in the detection results
    status: error
    duration: 3.08
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Windows Admon Default Group Policy Object Modified
  search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*"
    (displayName="Default Domain Policy" OR displayName="Default Domain Controllers
    Policy") | appendpipe [ | map search="search `wineventlog_security` EventCode=5136  AttributeSyntaxOID=2.5.5.12
    AttributeValue=$displayName$" | rename AttributeValue as displayName] | stats
    min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as
    gPCFileSysPath, values(src_user) as src_user, values(dcName) as dcName, values(dest_category)
    as dest_category, values(src_user_category) as src_user_category by displayName
    | `windows_admon_default_group_policy_object_modified_filter`'
  success: false
  tests:
  - name: True Positive Test
    test_type: unit
    success: false
    message: TEST ERROR
    exception: The observable field(s) {'src_user'} are missing in the detection results
    status: error
    duration: 7.63
    wait_duration: null
    resultCount: '1'
    runDuration: '2.158'
  - name: True Positive Test
    test_type: integration
    success: false
    message: 'TEST FAILED (PREEMPTIVE): associated unit test failed or encountered
      an error'
    exception: The observable field(s) {'src_user'} are missing in the detection results
    status: error
    duration: 3.17
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Windows Admon Group Policy Object Created
  search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*"
    versionNumber=0 displayName!="New Group Policy Object" | appendpipe [ | map search="search
    `wineventlog_security` EventCode=5136  AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$"
    | rename AttributeValue as displayName] | stats min(_time) as _time values(displayName)
    as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user,
    values(dcName) as dcName, values(dest_category) as dest_category, values(src_user_category)
    as src_user_category by displayName | `windows_admon_group_policy_object_created_filter`'
  success: false
  tests:
  - name: True Positive Test
    test_type: unit
    success: false
    message: TEST ERROR
    exception: The observable field(s) {'src_user'} are missing in the detection results
    status: error
    duration: 11.45
    wait_duration: null
    resultCount: '1'
    runDuration: '1.270'
  - name: True Positive Test
    test_type: integration
    success: false
    message: 'TEST FAILED (PREEMPTIVE): associated unit test failed or encountered
      an error'
    exception: The observable field(s) {'src_user'} are missing in the detection results
    status: error
    duration: 3.26
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Azure AD Admin Consent Bypassed by Service Principal
  search: '`azure_monitor_aad` (operationName="Add app role assignment to service
    principal" OR operationName="Add member to role*") src_user_type=servicePrincipal  |
    rename properties.* as *   | eval roleId = mvindex(''targetResources{}.modifiedProperties{}.newValue'',
    0)  | eval roleValue = mvindex(''targetResources{}.modifiedProperties{}.newValue'',
    1)  | eval roleDescription = mvindex(''targetResources{}.modifiedProperties{}.newValue'',
    2)  | eval user_id = mvindex(''targetResources{}.id'', 0), user=coalesce(user,mvindex(''targetResources{}.displayName'',
    0)) | rename initiatedBy.app.displayName as src_user  | stats count earliest(_time)
    as firstTime latest(_time) as lastTime by src_user user user_id roleId roleValue
    roleDescription | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`  |
    `azure_ad_admin_consent_bypassed_by_service_principal_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 5.84
    wait_duration: null
    resultCount: '1'
    runDuration: '0.654'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Azure AD Global Administrator Role Assigned
  search: '`azure_monitor_aad`  operationName="Add member to role"  properties.targetResources{}.modifiedProperties{}.newValue="\"Global
    Administrator\"" | rename properties.* as *, initiatedBy.user.userPrincipalName
    as userPrincipalName, targetResources{}.displayName as displayName | eval  initiatedBy
    = coalesce(userPrincipalName,src_user) | eval user = coalesce(user,mvfilter(displayName!="null"))
    | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
    by initiatedBy, result, operationName | `security_content_ctime(firstTime)` |
    `security_content_ctime(lastTime)` | `azure_ad_global_administrator_role_assigned_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 5.97
    wait_duration: null
    resultCount: '1'
    runDuration: '0.666'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Azure AD Privileged Role Assigned
  search: ' `azure_monitor_aad`  "operationName"="Add member to role" | rename properties.*
    as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName
    as displayName | eval  initiatedBy = coalesce(userPrincipalName,src_user) | eval
    user = coalesce(user,mvfilter(displayName!="null")) | rename targetResources{}.modifiedProperties{}.newValue  as
    roles | eval role=mvindex(roles,1) | stats count min(_time) as firstTime max(_time)
    as lastTime values(user) as user by initiatedBy, result, operationName, role |
    lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole
    description | search isprvilegedadrole = True | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)` | `azure_ad_privileged_role_assigned_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 5.94
    wait_duration: null
    resultCount: '1'
    runDuration: '0.648'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Azure AD Privileged Role Assigned to Service Principal
  search: ' `azure_monitor_aad`  operationName="Add member to role" | rename properties.*
    as * | search "targetResources{}.type"=ServicePrincipal | rename initiatedBy.user.userPrincipalName
    as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue  as roles
    | eval role=mvindex(roles,1) | rename targetResources{}.displayName as apps |
    eval displayName=mvindex(apps,0) | stats count min(_time) as firstTime max(_time)
    as lastTime values(displayName) as displayName by initiatedBy, result, operationName,
    role | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole
    description | search isprvilegedadrole = True | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)` | `azure_ad_privileged_role_assigned_to_service_principal_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 9.3
    wait_duration: null
    resultCount: '1'
    runDuration: '3.134'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Azure AD Service Principal New Client Credentials
  search: ' `azure_monitor_aad`  category=AuditLogs operationName="Update application*Certificates
    and secrets management*" | rename properties.* as * | rename  targetResources{}.*
    as * | rename modifiedProperties{}.* as * | eval src_user=coalesce(user,identity),
    newValue=mvfilter(newValue!="\"KeyDescription\"") | stats count min(_time) as
    firstTime max(_time) as lastTime values(displayName) as displayName values(src_ip)
    as src_ip values(eval(mvfilter(oldValue!="null"))) as oldValue by src_user, object,
    newValue | spath input=oldValue output=oldValues path={} | spath input=newValue
    output=newValues path={} | mvexpand newValues | where NOT newValues IN (oldValues)
    | fields - newValue, oldValue, oldValues | rename newValues as newValue | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)` | `azure_ad_service_principal_new_client_credentials_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 5.94
    wait_duration: null
    resultCount: '1'
    runDuration: '0.782'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Detect New Local Admin account
  search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators)
    | stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration
    values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category)
    as dest_category by user dest | where evCount=2 | fields - evCount, duration |
    `detect_new_local_admin_account_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 14.33
    wait_duration: null
    resultCount: '1'
    runDuration: '0.696'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
  search: '`wineventlog_security` EventCode=4738 (UserAccountControl="%%2096" OR MSADChangedAttributes="*Don''t
    Require Preauth'' - Enabled*") | eval MSADChangedAttributes="''Don''t Require
    Preauth'' - Enabled" | table _time, source, EventCode, src_user, src_user_category,
    user, user_category, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 6.08
    wait_duration: null
    resultCount: '1'
    runDuration: '0.630'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
- name: Windows AD Replication Request Initiated by User Account
  search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
    "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*",
    "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
    AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
    OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") | stats min(_time)
    as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName,
    ObjectServer, ObjectType, OperationType, status | rename SubjectDomainName as
    Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time
    | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
    | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid,
    Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName,
    ObjectServer, ObjectType, OperationType | stats min(attack_time) as _time values(TargetUserSid)
    as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
    values(Computer) as Computer, values(status) as status, values(src_category) as
    src_category, values(src_ip) as src_ip by TargetLogonId | `windows_ad_replication_request_initiated_by_user_account_filter`'
  success: true
  tests:
  - name: True Positive Test
    test_type: unit
    success: true
    message: TEST PASSED
    exception: null
    status: pass
    duration: 11.26
    wait_duration: null
    resultCount: '1'
    runDuration: '1.289'
  - name: True Positive Test
    test_type: integration
    success: true
    message: 'TEST SKIPPED: Skipping all integration tests'
    exception: null
    status: skip
    duration: 0
    wait_duration: null
    resultCount: null
    runDuration: null
untested_detections: []
percent_complete: UKNOWN
deprecated_detections: []
experimental_detections: []