mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
277 lines
11 KiB
YAML
277 lines
11 KiB
YAML
summary:
|
|
success: true
|
|
total_detections: 8
|
|
total_pass: 8
|
|
total_fail: 2
|
|
total_skipped: 0
|
|
total_untested: 0
|
|
total_experimental_or_deprecated: 0
|
|
success_rate: 100.0%
|
|
tested_detections:
|
|
- name: Detect Password Spray Attempts
|
|
search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts
|
|
values(Authentication.app) as app count(Authentication.user) as total_failures
|
|
from datamodel=Authentication.Authentication where Authentication.action="failure"
|
|
by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype,
|
|
_time span=2m | `drop_dm_object_name("Authentication")` ```fill out time buckets
|
|
for 0-count events during entire search length``` | appendpipe [| timechart limit=0
|
|
span=5m count | table _time] | fillnull value=0 unique_accounts, unique_src ```
|
|
remove duplicate & empty time buckets``` | sort - total_failures | dedup _time
|
|
``` Create aggregation field & apply to all null events``` | eval counter=src+"__"+sourcetype+"__"+signature_id
|
|
| eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)
|
|
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
|
|
by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts
|
|
> 30 and unique_accounts >= upperBound, 1, 0) | replace "::ffff:*" with * in src
|
|
| where isOutlier=1 | foreach * [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
|
|
| table _time, src, action, app, unique_accounts, total_failures, sourcetype,
|
|
signature_id | `detect_password_spray_attempts_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: FAIL
|
|
duration: 6.78
|
|
wait_duration: null
|
|
resultCount: '1'
|
|
runDuration: '1.397'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Internal Horizontal Port Scan
|
|
search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as
|
|
action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone)
|
|
as dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic
|
|
where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by
|
|
All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip span=1s _time All_Traffic.transport
|
|
| `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime
|
|
| stats min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount
|
|
values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone)
|
|
as src_zone by src_ip dest_port gtime transport | where totalDestIPCount>=250
|
|
| eval dest_port=transport + "/" + dest_port | stats min(_time) as _time values(action)
|
|
as action sum(totalDestIPCount) as totalDestIPCount values(src_category) as src_category
|
|
values(dest_port) as dest_ports values(dest_zone) as dest_zone values(src_zone)
|
|
as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: FAIL
|
|
duration: 7.82
|
|
wait_duration: null
|
|
resultCount: '1'
|
|
runDuration: '2.207'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Internal Vertical Port Scan
|
|
search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as
|
|
action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone)
|
|
as dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic
|
|
where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by
|
|
All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.transport
|
|
span=1s _time | `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin
|
|
span=1h gtime | stats min(_time) as _time values(action) as action dc(eval(if(dest_port<1024
|
|
AND transport="tcp",dest_port,null))) as privilegedDestTcpPortCount dc(eval(if(transport="tcp",dest_port,null)))
|
|
as totalDestTcpPortCount dc(eval(if(dest_port<1024 AND transport="udp",dest_port,null)))
|
|
as privilegedDestUdpPortCount dc(eval(if(transport="udp",dest_port,null))) as
|
|
totalDestUdpPortCount values(src_category) as src_category values(dest_zone) as
|
|
dest_zone values(src_zone) as src_zone by src_ip dest_ip transport gtime | eval
|
|
totalDestPortCount=totalDestUdpPortCount+totalDestTcpPortCount, privilegedDestPortCount=privilegedDestTcpPortCount+privilegedDestUdpPortCount|
|
|
where (totalDestPortCount>=500 AND privilegedDestPortCount>=20) | fields - gtime
|
|
| `internal_vertical_port_scan_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: pass
|
|
duration: 11.52
|
|
wait_duration: null
|
|
resultCount: '1'
|
|
runDuration: '5.078'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Windows AD add Self to Group
|
|
search: '`wineventlog_security` EventCode IN (4728) | where user=src_user | stats
|
|
min(_time) as _time dc(user) as usercount, values(user) as user values(user_category)
|
|
as user_category values(src_user_category) as src_user_category values(dvc) as
|
|
dvc by signature, Group_Name, src_user | `windows_ad_add_self_to_group_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: pass
|
|
duration: 5.61
|
|
wait_duration: null
|
|
resultCount: '1'
|
|
runDuration: '0.635'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Windows Increase in Group or Object Modification Activity
|
|
search: '`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764) | bucket
|
|
span=5m _time | stats values(object) as object, dc(object) as objectCount, values(src_user_category)
|
|
as src_user_category, values(dest) as dest, values(dest_category) as dest_category
|
|
by _time, src_user, signature, status | eventstats avg(objectCount) as comp_avg,
|
|
stdev(objectCount) as comp_std by src_user, signature | eval upperBound=(comp_avg+comp_std)
|
|
| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0) |
|
|
search isOutlier=1 | `windows_increase_in_group_or_object_modification_activity_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: pass
|
|
duration: 6.36
|
|
wait_duration: null
|
|
resultCount: '2'
|
|
runDuration: '1.390'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Windows Increase in User Modification Activity
|
|
search: '`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
|
|
| bucket span=5m _time | stats values(TargetDomainName) as TargetDomainName,
|
|
values(user) as user, dc(user) as userCount, values(user_category) as user_category,
|
|
values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category)
|
|
as dest_category by _time, src_user, signature, status | eventstats avg(userCount)
|
|
as comp_avg , stdev(userCount) as comp_std by src_user, signature | eval upperBound=(comp_avg+comp_std*3)
|
|
| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) | search
|
|
isOutlier=1 | stats values(TargetDomainName) as TargetDomainName, values(user)
|
|
as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category)
|
|
as src_user_category, values(dest) as dest, values(dest_category) as dest_category
|
|
values(signature) as signature by _time, src_user, status | `windows_increase_in_user_modification_activity_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: FAIL
|
|
duration: 6.18
|
|
wait_duration: null
|
|
resultCount: '1'
|
|
runDuration: '0.722'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Windows Network Share Discovery With Net
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
|
|
max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit)
|
|
as user_bunit FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe"
|
|
OR Processes.orig_process_name="net.exe") AND (Processes.process="*net*view*"
|
|
OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec
|
|
Processes.parent_process_exec Processes.process Processes.parent_process | `drop_dm_object_name(Processes)`
|
|
| regex process="net\s+view|net\s+share" | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `windows_network_share_discovery_with_net_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: pass
|
|
duration: 6.05
|
|
wait_duration: null
|
|
resultCount: '1'
|
|
runDuration: '0.886'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
- name: Windows Vulnerable Driver Installed
|
|
search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" |
|
|
table _time dest EventCode ImagePath ServiceName ServiceType | lookup loldrivers
|
|
driver_name AS ImagePath OUTPUT is_driver driver_description | search is_driver
|
|
= TRUE | `windows_vulnerable_driver_installed_filter`'
|
|
success: true
|
|
tests:
|
|
- name: True Positive Test
|
|
test_type: unit
|
|
success: true
|
|
message: TEST PASSED
|
|
exception: null
|
|
status: pass
|
|
duration: 6.11
|
|
wait_duration: null
|
|
resultCount: '3'
|
|
runDuration: '0.857'
|
|
- name: True Positive Test
|
|
test_type: integration
|
|
success: true
|
|
message: 'TEST SKIPPED: Skipping all integration tests'
|
|
exception: null
|
|
status: skip
|
|
duration: 0
|
|
wait_duration: null
|
|
resultCount: null
|
|
runDuration: null
|
|
untested_detections: []
|
|
percent_complete: UKNOWN
|
|
deprecated_detections: []
|
|
experimental_detections: []
|