mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
92 lines
3.7 KiB
JSON
92 lines
3.7 KiB
JSON
{
|
|
"asset_type": "account",
|
|
"channel": "webfraud",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "session_id",
|
|
"rule_description": "This search is used to examine web sessions in order to identify unnaturally rapid clicks with near-perfect cadence (high periodicity or low standard deviation), which resemble a script-driven session.",
|
|
"rule_title": "Web Fraud Detection: Anomalous User Clickspeed"
|
|
},
|
|
"risk": {
|
|
"risk_object": "session_id",
|
|
"risk_object_type": [
|
|
"other"
|
|
],
|
|
"risk_score": 40
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "session_id",
|
|
"suppress_period": "3600s"
|
|
}
|
|
},
|
|
"creation_date": "2018-07-12",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Network Communications"
|
|
],
|
|
"data_sourcetypes": [
|
|
"stream:http"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Palo Alto Firewall",
|
|
"Bro"
|
|
]
|
|
},
|
|
"eli5": "It's suspicious when someone or something is moving throughout your website too quickly or with a perfect click cadence. Fortunately, it's easy to detect by calculating the time between clicks for each session and highlighting the anomalous behavior.",
|
|
"how_to_implement": "Start with a dataset that allows you to see clickstream data for each user click on the website. That data must have a time stamp and must contain a reference to the session identifier being used by the website. This ties the clicks together into clickstreams. This value is usually found in the http cookie. With a bit of tuning, a version of this search could be used in high-volume scenarios, such as scraping, crawling, application DDOS, credit-card testing, account takeover, etc. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.",
|
|
"known_false_positives": "As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosly written detections that simply detect anamoluous behavior.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "Mayhem@splunk.com",
|
|
"name": "Jim Apger"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 6"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Valid Accounts"
|
|
],
|
|
"nist": [
|
|
"DE.AE",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2018-10-08",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "Mayhem@splunk.com",
|
|
"name": "Jim Apger"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://en.wikipedia.org/wiki/Session_ID",
|
|
"https://en.wikipedia.org/wiki/Session_(computer_science)",
|
|
"https://en.wikipedia.org/wiki/HTTP_cookie",
|
|
"https://splunkbase.splunk.com/app/1809/"
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=stream:http http_content_type=text* | rex field=cookie \"form_key=(?<session_id>\\w+)\" | streamstats window=2 current=1 range(_time) as TimeDelta by session_id | where TimeDelta>0 |stats count stdev(TimeDelta) as ClickSpeedStdDev avg(TimeDelta) as ClickSpeedAvg by session_id | where count>5 AND (ClickSpeedStdDev<.5 OR ClickSpeedAvg<.5)",
|
|
"search_description": "This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.",
|
|
"search_id": "31337bbb-bc22-4752-b599-ef192df2dc7a",
|
|
"search_name": "Web Fraud - Anomalous User Clickspeed",
|
|
"search_type": "detection",
|
|
"security_domain": "threat",
|
|
"spec_version": 1,
|
|
"status": "production",
|
|
"team_notes": "No notes",
|
|
"version": "1.0"
|
|
}
|