mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
88 lines
3.6 KiB
JSON
88 lines
3.6 KiB
JSON
{
|
|
"asset_type": "Windows",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "user, dest",
|
|
"rule_description": "Possible attempt at credential dumping via PowerShell was detected on $dest$ by $user$.",
|
|
"rule_title": "Event ID 4663 Specifying PowerShell Reading From LSASS.exe Identified on $dest$."
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 40
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "user, dest, process",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2018-08-28",
|
|
"data_metadata": {
|
|
"data_eventtypes": [
|
|
"wineventlog_security"
|
|
],
|
|
"data_source": [
|
|
"Windows Event Logs"
|
|
],
|
|
"providing_technologies": [
|
|
"Microsoft Windows"
|
|
]
|
|
},
|
|
"eli5": "This search looks for Windows Event Code(signature_id) 4663 (object access), where the process performing the access is PowerShell.exe, the target process of the access is lsass.exe, and the access mask is given as 0x10. This is consistent with the use of PowerShell to execute Mimikatz using sekurlsa::logonpasswords. It will return the host where the activity occurred, the process and associated id, the enabled privilege, and the message in the event.",
|
|
"how_to_implement": "You must be ingesting Windows Security logs. You must also enable the account change auditing here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorWindowseventlogdata. Additionally, this search requires you to enable your Group Management Audit Logs in your Local Windows Security Policy and to be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/. Finally, please make sure that the local administrator group name is \"Administrators\" to be able to look for the right group membership changes.",
|
|
"known_false_positives": "The activity may be legitimate. PowerShell is often used by administrators to perform various tasks, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5",
|
|
"CIS 16"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Credential Access",
|
|
"Credential Dumping"
|
|
],
|
|
"nist": [
|
|
"PR.IP",
|
|
"PR.AC",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2019-02-28",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "eventtype = wineventlog_security signature_id=4663 Process_Name=*powershell.exe Object_Name=*lsass.exe Access_Mask=0x10 | stats count min(_time) as firstTime max(_time) as lastTime by dest, Process_Name, Process_ID, Message | rename Process_Name as process | `ctime(firstTime)`| `ctime(lastTime)`",
|
|
"search_description": "This search looks for PowerShell reading lsass memory consistent with credential dumping.",
|
|
"search_id": "2c365e57-4414-4540-8dc0-73ab10729996",
|
|
"search_name": "Detect Mimikatz Via PowerShell And EventCode 4663",
|
|
"search_type": "detection",
|
|
"security_domain": "access",
|
|
"spec_version": 1,
|
|
"status": "production",
|
|
"team_notes": "",
|
|
"version": "2.0"
|
|
}
|