mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
dluxtron
56 lines
2.4 KiB
YAML
56 lines
2.4 KiB
YAML
name: Internal Vulnerability Scan
|
|
id: 46f946ed-1c78-4e96-9906-c7a4be15e39b
|
|
version: 1
|
|
date: '2023-10-27'
|
|
author: Dean Luxton
|
|
status: experimental
|
|
type: TTP
|
|
data_source: []
|
|
description: This analytic detects internal hosts triggering multiple IDS signatures (either more than 25 signatures against a single host, or a single signature across over 25 destinations), which can be indicative of active vulnerability scanning performed within the network.
|
|
search: '| tstats `security_content_summariesonly` values(IDS_Attacks.action) as action
|
|
values(IDS_Attacks.src_category) as src_category values(IDS_Attacks.dest_category)
|
|
as dest_category count from datamodel=Intrusion_Detection.IDS_Attacks where IDS_Attacks.src
|
|
IN (10.0.0.0/8,192.168.0.0/16,172.16.0.0/12) IDS_Attacks.severity IN (critical,
|
|
high, medium) by IDS_Attacks.src IDS_Attacks.severity IDS_Attacks.signature IDS_Attacks.dest
|
|
IDS_Attacks.dest_port IDS_Attacks.transport span=1s _time | `drop_dm_object_name("IDS_Attacks")`
|
|
| eval gtime=_time | bin span=1h gtime | eventstats count as sevCount by severity
|
|
src | eventstats count as sigCount by signature src | eval severity=severity +"("+sevCount+")"
|
|
| eval signature=signature +"("+sigCount+")" | eval dest_port=transport + "/" +
|
|
dest_port | stats min(_time) as _time values(action) as action dc(dest) as destCount
|
|
dc(signature) as sigCount values(signature) values(src_category) as src_category
|
|
values(dest_category) as dest_category values(severity) as severity values(dest_port)
|
|
as dest_ports by src gtime | fields - gtime | where destCount>25 OR sigCount>25
|
|
| `internal_vulnerability_scan_filter`'
|
|
how_to_implement: CIM mapped IDS/IPS logs are a required to drive this detection.
|
|
known_false_positives: Vulnerability Scanners and informational / low severity signatures.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Network Discovery
|
|
asset_type: Endpoint
|
|
confidence: 80
|
|
impact: 80
|
|
message: Large volume of IDS signatures triggered by $src$
|
|
mitre_attack_id:
|
|
- T1595.002
|
|
- T1046
|
|
observable:
|
|
- name: src
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 64
|
|
required_fields:
|
|
- _time
|
|
- IDS_Attacks.action
|
|
- IDS_Attacks.src
|
|
- IDS_Attacks.dest
|
|
- IDS_Attacks.dest_port
|
|
- IDS_Attacks.severity
|
|
- IDS_Attacks.signature
|
|
- IDS_Attacks.transport
|
|
security_domain: network |