mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
name: Windows Create Local Account
|
|
id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb
|
|
version: 1
|
|
date: '2022-10-05'
|
|
author: Michael Haag, Splunk
|
|
type: Anomaly
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
|
|
search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
|
|
result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change
|
|
where All_Changes.result_id=4720 by
|
|
All_Changes.user All_Changes.dest All_Changes.result All_Changes.action | `drop_dm_object_name("All_Changes")` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
|
|
| `windows_create_local_account_filter`'
|
|
how_to_implement: 'This search requires you to have enabled your Group Management
|
|
Audit Logs in your Local Windows Security Policy and be ingesting those logs. More
|
|
information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
|
|
known_false_positives: It is possible that an administrator created the account. Verifying activity with an administrator is advised. This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed. Restrict to critical infrastructure to reduce any volume.
|
|
references:
|
|
- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
|
|
tags:
|
|
analytic_story:
|
|
- Account Monitoring and Controls
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 90
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Persistence
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/4720.log
|
|
impact: 20
|
|
kill_chain_phases:
|
|
- Installation
|
|
- Actions on Objectives
|
|
message: The following $user$ was added to $dest$ as a local account.
|
|
mitre_attack_id:
|
|
- T1136.001
|
|
- T1136
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- All_Changes.user
|
|
- All_Changes.dest
|
|
- All_Changes.result
|
|
- All_Changes.action
|
|
risk_score: 18
|
|
security_domain: endpoint |