mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
87 lines
2.6 KiB
JSON
87 lines
2.6 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "host, user",
|
|
"rule_description": "Host $host$ generated an alert for the macOS RAT ColdRoot",
|
|
"rule_title": "Osquery ColdRoot alert for $host$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "host",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 80
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "host",
|
|
"suppress_period": "3600s"
|
|
}
|
|
},
|
|
"creation_date": "2019-01-29",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Alerts"
|
|
],
|
|
"data_source": [
|
|
"Endpoint"
|
|
],
|
|
"providing_technologies": [
|
|
"OSquery"
|
|
]
|
|
},
|
|
"eli5": "The search looks at the Alerts data model to identify those generated from the osquery osx-attacks.conf pack, which search for the ColdRoot RAT.",
|
|
"how_to_implement": "In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model",
|
|
"known_false_positives": "There are no known false positives.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 4",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Installation",
|
|
"Command and Control"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Persistence",
|
|
"Command and Control"
|
|
],
|
|
"nist": [
|
|
"DE.DP",
|
|
"DE.CM",
|
|
"PR.PT"
|
|
]
|
|
},
|
|
"modification_date": "2019-01-29",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| from datamodel Alerts.Alerts | search app=osquery:results (name=pack_osx-attacks_OSX_ColdRoot_RAT_Launchd OR name=pack_osx-attacks_OSX_ColdRoot_RAT_Files) | rename columns.path as path | bucket _time span=30s | stats count(path) by _time, host, user, path",
|
|
"search_description": "This search looks for ColdRoot events from the osx-attacks osquery pack.",
|
|
"search_id": "a6fffe5e-05c3-4c04-badc-887607fbb8dc",
|
|
"search_name": "Osquery pack - ColdRoot detection",
|
|
"search_type": "detection",
|
|
"security_domain": "threat",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|