mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
85 lines
3.4 KiB
JSON
85 lines
3.4 KiB
JSON
{
|
|
"asset_type": "account",
|
|
"channel": "webfraud",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "user",
|
|
"rule_description": "This search is used to identify user accounts, $user$, that share common passwords",
|
|
"rule_title": "Web Fraud Detection: Password Sharing Across Accounts"
|
|
},
|
|
"risk": {
|
|
"risk_object": "user",
|
|
"risk_object_type": [
|
|
"other"
|
|
],
|
|
"risk_score": 10
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "user",
|
|
"suppress_period": "3600s"
|
|
}
|
|
},
|
|
"creation_date": "2018-07-12",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Network Communications"
|
|
],
|
|
"data_sourcetypes": [
|
|
"stream:http"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Palo Alto Firewall",
|
|
"Bro"
|
|
]
|
|
},
|
|
"eli5": "A common password across user accounts generally indicates that the users are choosing poor passwords or that a fraudster has a common password across multiple accounts embedded within a script. The search will extract the username and password information from the form_data field, then calculate the number and values for usernames that have the same passwords. Finally, it outputs the values where the unique usernames sharing passwords are greater than 5",
|
|
"how_to_implement": "We need to start with a dataset that allows us to see the values of usernames and passwords that users are submitting to the website hosting the Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized or hashed value of a password is acceptable and certainly preferable to a clear-text password. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.",
|
|
"known_false_positives": "As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "Mayhem@splunk.com",
|
|
"name": "Jim Apger"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 16"
|
|
],
|
|
"nist": [
|
|
"DE.DP"
|
|
]
|
|
},
|
|
"modification_date": "2018-10-08",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "Mayhem@splunk.com",
|
|
"name": "Jim Apger"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://en.wikipedia.org/wiki/Session_ID",
|
|
"https://en.wikipedia.org/wiki/Session_(computer_science)",
|
|
"https://en.wikipedia.org/wiki/HTTP_cookie",
|
|
"https://splunkbase.splunk.com/app/1809/"
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=stream:http http_content_type=text* uri=/magento2/customer/account/loginPost* | rex field=form_data \"login\\[username\\]=(?<Username>[^&|^$]+)\" | rex field=form_data \"login\\[password\\]=(?<Password>[^&|^$]+)\" | stats dc(Username) as UniqueUsernames values(Username) as user list(src_ip) as src_ip by Password|where UniqueUsernames>5",
|
|
"search_description": "This search is used to identify user accounts that share a common password.",
|
|
"search_id": "31337a1a-53b9-4e05-96e9-55c934cb71d3",
|
|
"search_name": "Web Fraud - Password Sharing Across Accounts",
|
|
"search_type": "detection",
|
|
"security_domain": "threat",
|
|
"spec_version": 1,
|
|
"status": "production",
|
|
"team_notes": "No notes",
|
|
"version": "1.0"
|
|
}
|