mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
88 lines
3.7 KiB
JSON
88 lines
3.7 KiB
JSON
{
|
|
"asset_type": "Windows",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "user, dest",
|
|
"rule_description": "Possible attempt at credential dumping via PowerShell was detected on $dest$ by $user$.",
|
|
"rule_title": "Event Code 4703 Specifying PowerShell Acquiring A Token with SeDebugPrivilege Identified on $dest$."
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 40
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "user, dest, process",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2018-08-28",
|
|
"data_metadata": {
|
|
"data_eventtypes": [
|
|
"wineventlog_security"
|
|
],
|
|
"data_source": [
|
|
"Windows Event Logs"
|
|
],
|
|
"providing_technologies": [
|
|
"Microsoft Windows"
|
|
]
|
|
},
|
|
"eli5": "This search looks for Windows Event Code(signature_id) 4703 (token right adjusted), where the process requesting the token change is PowerShell.exe and the requested privilege is \"SeDebugPrivilege\". This is consistent with the use of PowerShell to execute Mimikatz using sekurlsa::logonpasswords. It will return the host where the activity occurred, the process and associated id, the enabled privilege, and the message in the event.",
|
|
"how_to_implement": "You must be ingesting Windows Security logs. You must also enable the account change auditing here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorWindowseventlogdata. Additionally, this search requires you to enable your Group Management Audit Logs in your Local Windows Security Policy and to be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/. Finally, please make sure that the local administrator group name is \"Administrators\" to be able to look for the right group membership changes.",
|
|
"known_false_positives": "The activity may be legitimate. PowerShell is often used by administrators to perform various tasks, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5",
|
|
"CIS 16"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Credential Access",
|
|
"Credential Dumping"
|
|
],
|
|
"nist": [
|
|
"PR.IP",
|
|
"PR.AC",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2019-02-27",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "eventtype=wineventlog_security signature_id=4703 Process_Name=*powershell.exe | rex field=Message \"Enabled Privileges:\\s+(?<privs>\\w+)\\s+Disabled Privileges:\" | where privs=\"SeDebugPrivilege\" | stats count min(_time) as firstTime max(_time) as lastTime by dest, Process_Name, privs, Process_ID, Message | rename privs as \"Enabled Privilege\" | rename Process_Name as process | `ctime(firstTime)`| `ctime(lastTime)`",
|
|
"search_description": "This search looks for PowerShell requesting privileges consistent with credential dumping.",
|
|
"search_id": "98917be2-bfc8-475a-8618-a9bb06575188",
|
|
"search_name": "Detect Mimikatz Via PowerShell And EventCode 4703",
|
|
"search_type": "detection",
|
|
"security_domain": "access",
|
|
"spec_version": 1,
|
|
"status": "production",
|
|
"team_notes": "",
|
|
"version": "2.0"
|
|
}
|