mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
David Dorsey
91 lines
3.4 KiB
YAML
91 lines
3.4 KiB
YAML
asset_type: account
|
|
confidence: medium
|
|
creation_date: '2018-07-12'
|
|
data_metadata:
|
|
data_source:
|
|
- Network Communications
|
|
data_sourcetypes:
|
|
- stream:http
|
|
providing_technologies:
|
|
- Splunk Stream
|
|
description: This search is used to identify user accounts that share a common password.
|
|
detect:
|
|
splunk:
|
|
correlation_rule:
|
|
notable:
|
|
nes_fields: user
|
|
rule_description: This search is used to identify user accounts, $user$, that
|
|
share common passwords
|
|
rule_title: 'Web Fraud Detection: Password Sharing Across Accounts'
|
|
risk:
|
|
risk_object: user
|
|
risk_object_type:
|
|
- other
|
|
risk_score: 10
|
|
schedule:
|
|
cron_schedule: 0 * * * *
|
|
earliest_time: -70m@m
|
|
latest_time: -10m@m
|
|
search: sourcetype=stream:http http_content_type=text* uri=/magento2/customer/account/loginPost* |
|
|
rex field=form_data "login\[username\]=(?<Username>[^&|^$]+)" | rex field=form_data
|
|
"login\[password\]=(?<Password>[^&|^$]+)" | stats dc(Username) as UniqueUsernames
|
|
values(Username) as user list(src_ip) as src_ip by Password|where UniqueUsernames>5
|
|
suppress:
|
|
suppress_fields: user
|
|
suppress_period: 3600s
|
|
eli5: A common password across user accounts generally indicates that the users are
|
|
choosing poor passwords or that a fraudster has a common password across multiple
|
|
accounts embedded within a script. The search will extract the username and password
|
|
information from the form_data field, then calculate the number and values for usernames
|
|
that have the same passwords. Finally, it outputs the values where the unique usernames
|
|
sharing passwords are greater than 5
|
|
entities:
|
|
- user
|
|
how_to_implement: We need to start with a dataset that allows us to see the values
|
|
of usernames and passwords that users are submitting to the website hosting the
|
|
Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized
|
|
or hashed value of a password is acceptable and certainly preferable to a clear-text
|
|
password. Common data sources used for this detection are customized Apache logs,
|
|
customized IIS, and Splunk Stream.
|
|
id: 31337a1a-53b9-4e05-96e9-55c934cb71d3
|
|
investigations:
|
|
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
|
name: Get Notable History
|
|
type: splunk
|
|
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
|
name: Get Notable Info
|
|
type: splunk
|
|
- id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89
|
|
name: Get Web Session Information via session_id
|
|
type: splunk
|
|
- id: 5df39b3f-447d-4869-b673-8f45ad4616fe
|
|
name: Get Emails From Specific Sender
|
|
type: splunk
|
|
known_false_positives: As is common with many fraud-related searches, we are usually
|
|
looking to attribute risk or synthesize relevant context with loosely written detections
|
|
that simply detect anamoluous behavior.
|
|
maintainers:
|
|
- company: Splunk
|
|
email: Mayhem@splunk.com
|
|
name: Jim Apger
|
|
mappings:
|
|
cis20:
|
|
- CIS 16
|
|
nist:
|
|
- DE.DP
|
|
modification_date: '2018-10-08'
|
|
name: Web Fraud - Password Sharing Across Accounts
|
|
original_authors:
|
|
- company: Splunk
|
|
email: Mayhem@splunk.com
|
|
name: Jim Apger
|
|
references:
|
|
- https://en.wikipedia.org/wiki/Session_ID
|
|
- https://en.wikipedia.org/wiki/Session_(computer_science)
|
|
- https://en.wikipedia.org/wiki/HTTP_cookie
|
|
- https://splunkbase.splunk.com/app/1809/
|
|
security_domain: threat
|
|
spec_version: 2
|
|
type: splunk
|
|
version: '1.0'
|