admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
14915ca789aef56c7eefb6a6a41adf8eee710fcf
splunk-security_content/docs/detections.md
T
divious1 75c24a9f34 added markup
2021-03-01 13:49:16 -05:00

579 KiB
Raw Blame History

Splunk Security Content Detections

security_content

All the detections shipped to different Splunk products. Below is a breakdown by kind.

Cloud

details

Endpoint

details

Network

details

Application

details

Web

details

AWS Cross Account Activity From Previously Unseen Account

This search looks for AssumeRole events where an IAM role in a different account is requested for the first time. This search is deprecated and have been translated to use the latest Authentication Datamodel.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Authentication
  • ATT&CK:
  • Last Updated: 2020-05-28
details

Search


| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role 
| `drop_dm_object_name(Authentication)` 
| rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" 
| where vendor_account != dest_account 
| rename vendor_account as requestingAccountId dest_account as requestedAccountId 
| lookup previously_seen_aws_cross_account_activity requestingAccountId, requestedAccountId, OUTPUTNEW firstTime 
| eval status = if(firstTime > relative_time(now(), "-24h@h"),"New Cross Account Activity","Previously Seen") 
|  where status = "New Cross Account Activity" 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `aws_cross_account_activity_from_previously_unseen_account_filter`

Associated Analytic Story

  • Suspicious Cloud Authentication Activities

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen AWS Cross Account Activity - Initial to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search Previously Seen AWS Cross Account Activity - Update to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the aws_cross_account_activity_from_previously_unseen_account_filter macro.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.

Reference

Test Dataset

version: 1

AWS Detect Users creating keys with encrypt policy without MFA

This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1486
  • Last Updated: 2021-01-11
details

Search

`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy 
| spath input=requestParameters.policy output=key_policy_statements path=Statement{} 
| mvexpand key_policy_statements 
| spath input=key_policy_statements output=key_policy_action_1 path=Action 
| spath input=key_policy_statements output=key_policy_action_2 path=Action{} 
| eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2) 
| spath input=key_policy_statements output=key_policy_principal path=Principal.AWS 
| search key_policy_action="kms:Encrypt" AND key_policy_principal="*" 
| stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
|`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`

Associated Analytic Story

  • Ransomware Cloud

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs

Required field

ATT&CK

ID Technique Tactic
T1486 Data Encrypted for Impact Impact

Kill Chain Phase

Known False Positives

unknown

Reference

Test Dataset

version: 1

AWS Detect Users with KMS keys performing encryption S3

This search provides detection of users with KMS keys performing encryption specifically against S3 buckets.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1486
  • Last Updated: 2021-01-11
details

Search

`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" 
| rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file 
| stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
|`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`

Associated Analytic Story

  • Ransomware Cloud

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs

Required field

ATT&CK

ID Technique Tactic
T1486 Data Encrypted for Impact Impact

Kill Chain Phase

Known False Positives

bucket with S3 encryption

Reference

Test Dataset

version: 1

AWS Network Access Control List Created with All Open Ports

The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1562.007
  • Last Updated: 2021-01-11
details

Search

`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 
| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 
| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' 
| where port_range>1024] 
| fillnull 
| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `aws_network_access_control_list_created_with_all_open_ports_filter`

Associated Analytic Story

  • AWS Network ACL Activity

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs.

Required field

ATT&CK

ID Technique Tactic
T1562.007 Disable or Modify Cloud Firewall Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.

Reference

Test Dataset

version: 2

AWS Network Access Control List Deleted

Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1562.007
  • Last Updated: 2021-01-12
details

Search

`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false 
| fillnull 
| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `aws_network_access_control_list_deleted_filter`

Associated Analytic Story

  • AWS Network ACL Activity

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.

Required field

ATT&CK

ID Technique Tactic
T1562.007 Disable or Modify Cloud Firewall Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It's possible that a user has legitimately deleted a network ACL.

Reference

Test Dataset

version: 2

AWS SAML Access by Provider User and Principal

This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078
  • Last Updated: 2021-01-26
details

Search

`cloudtrail` eventName=Assumerolewithsaml 
| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
|`aws_saml_access_by_provider_user_and_principal_filter`

Associated Analytic Story

  • Cloud Federated Credential Abuse

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.

Reference

Test Dataset

version: 1

AWS SAML Update identity provider

This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078
  • Last Updated: 2021-01-26
details

Search

`cloudtrail` eventName=UpdateSAMLProvider 
| stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
|`aws_saml_update_identity_provider_filter`

Associated Analytic Story

  • Cloud Federated Credential Abuse

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs.

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.

Reference

Test Dataset

version: 1

Abnormally High Number Of Cloud Infrastructure API Calls

This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.004
  • Last Updated: 2020-09-07
details

Search


| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h 
| `drop_dm_object_name("All_Changes")` 
| eval HourOfDay=strftime(_time, "%H") 
| eval HourOfDay=floor(HourOfDay/4)*4 
| eval DayOfWeek=strftime(_time, "%w") 
| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
| join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] 
| where cardinality >=16 
| apply cloud_excessive_api_calls_v1 threshold=0.005 
| rename "IsOutlier(api_calls)" as isOutlier 
| where isOutlier=1 
| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) 
| where api_calls > expected_upper_threshold 
| eval distance_from_threshold = api_calls - expected_upper_threshold 
| table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold 
| `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`

Associated Analytic Story

  • Suspicious Cloud User Activities

How To Implement

You must be ingesting your cloud infrastructure logs. You also must run the baseline search Baseline Of Cloud Infrastructure API Calls Per User to create the probability density function.

Required field

ATT&CK

ID Technique Tactic
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Reference

Test Dataset

version: 1

Abnormally High Number Of Cloud Instances Destroyed

This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.004
  • Last Updated: 2020-08-21
details

Search


| tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h 
| `drop_dm_object_name("All_Changes")` 
| eval HourOfDay=strftime(_time, "%H") 
| eval HourOfDay=floor(HourOfDay/4)*4 
| eval DayOfWeek=strftime(_time, "%w") 
| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
| join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] 
| where cardinality >=16 
| apply cloud_excessive_instances_destroyed_v1 threshold=0.005 
| rename "IsOutlier(instances_destroyed)" as isOutlier 
| where isOutlier=1 
| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) 
| eval distance_from_threshold = instances_destroyed - expected_upper_threshold 
| table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id 
| `abnormally_high_number_of_cloud_instances_destroyed_filter`

Associated Analytic Story

  • Suspicious Cloud Instance Activities

How To Implement

You must be ingesting your cloud infrastructure logs. You also must run the baseline search Baseline Of Cloud Instances Destroyed to create the probability density function.

Required field

ATT&CK

ID Technique Tactic
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.

Reference

Test Dataset

version: 1

Abnormally High Number Of Cloud Instances Launched

This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.004
  • Last Updated: 2020-08-21
details

Search


| tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h 
| `drop_dm_object_name("All_Changes")` 
| eval HourOfDay=strftime(_time, "%H") 
| eval HourOfDay=floor(HourOfDay/4)*4 
| eval DayOfWeek=strftime(_time, "%w") 
| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
| join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] 
| where cardinality >=16 
| apply cloud_excessive_instances_created_v1 threshold=0.005 
| rename "IsOutlier(instances_launched)" as isOutlier 
| where isOutlier=1 
| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) 
| eval distance_from_threshold = instances_launched - expected_upper_threshold 
| table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id 
| `abnormally_high_number_of_cloud_instances_launched_filter`

Associated Analytic Story

  • Cloud Cryptomining

  • Suspicious Cloud Instance Activities

How To Implement

You must be ingesting your cloud infrastructure logs. You also must run the baseline search Baseline Of Cloud Instances Launched to create the probability density function.

Required field

ATT&CK

ID Technique Tactic
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.

Reference

Test Dataset

version: 2

Abnormally High Number Of Cloud Security Group API Calls

This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.004
  • Last Updated: 2020-09-07
details

Search


| tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h 
| `drop_dm_object_name("All_Changes")` 
| eval HourOfDay=strftime(_time, "%H") 
| eval HourOfDay=floor(HourOfDay/4)*4 
| eval DayOfWeek=strftime(_time, "%w") 
| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
| join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] 
| where cardinality >=16 
| apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 
| rename "IsOutlier(security_group_api_calls)" as isOutlier 
| where isOutlier=1 
| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) 
| where security_group_api_calls > expected_upper_threshold 
| eval distance_from_threshold = security_group_api_calls - expected_upper_threshold 
| table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold 
| `abnormally_high_number_of_cloud_security_group_api_calls_filter`

Associated Analytic Story

  • Suspicious Cloud User Activities

How To Implement

You must be ingesting your cloud infrastructure logs. You also must run the baseline search Baseline Of Cloud Security Group API Calls Per User to create the probability density function model.

Required field

ATT&CK

ID Technique Tactic
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Reference

Test Dataset

version: 1

Access LSASS Memory for Dump Creation

Detect memory dumping of the LSASS process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1003.001
  • Last Updated: 2019-12-06
details

Search

`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `access_lsass_memory_for_dump_creation_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.

Reference

Test Dataset

version: 2

Applying Stolen Credentials via Mimikatz modules

This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1055 Process Injection Defense Evasion, Privilege Escalation
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence
T1134 Access Token Manipulation Defense Evasion, Privilege Escalation
T1543 Create or Modify System Process Persistence, Privilege Escalation
T1547 Boot or Logon Autostart Execution Persistence, Privilege Escalation
T1548 Abuse Elevation Control Mechanism Defense Evasion, Privilege Escalation
T1554 Compromise Client Software Binary Persistence
T1556 Modify Authentication Process Credential Access, Defense Evasion
T1558 Steal or Forge Kerberos Tickets Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Applying Stolen Credentials via PowerSploit modules

Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical accounts. This detection indicates such activities carried out by PowerSploit exploit kit APIs.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1055 Process Injection Defense Evasion, Privilege Escalation
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence
T1134 Access Token Manipulation Defense Evasion, Privilege Escalation
T1543 Create or Modify System Process Persistence, Privilege Escalation
T1547 Boot or Logon Autostart Execution Persistence, Privilege Escalation
T1548 Abuse Elevation Control Mechanism Defense Evasion, Privilege Escalation
T1554 Compromise Client Software Binary Persistence
T1556 Modify Authentication Process Credential Access, Defense Evasion
T1558 Steal or Forge Kerberos Tickets Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Assessment of Credential Strength via DSInternals modules

This detection identifies use of DSInternals modules that verify password strength, i.e., identify week accounts that would be easily compromised.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence
T1087 Account Discovery Discovery
T1201 Password Policy Discovery Discovery
T1552 Unsecured Credentials Credential Access
T1555 Credentials from Password Stores Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Attempt To Add Certificate To Untrusted Store

Attempt to add a certificate to the certificate store

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1553.004
  • Last Updated: 2020-11-03
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `attempt_to_add_certificate_to_untrusted_store_filter`

Associated Analytic Story

  • Disabling Security Tools

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1553.004 Install Root Certificate Defense Evasion

Kill Chain Phase

  • Installation

  • Actions on Objectives

Known False Positives

There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems.

Reference

Test Dataset

version: 6

Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass

Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1059.001
  • Last Updated: 2020-11-06
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
| `drop_dm_object_name(Registry)` 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` 
| `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`

Associated Analytic Story

  • Malicious PowerShell

  • Credential Dumping

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be ingesting logs with the fields registry_path, registry_key_name, and registry_value_name from your endpoints.

Required field

ATT&CK

ID Technique Tactic
T1059.001 PowerShell Execution

Kill Chain Phase

  • Installation

  • Actions on Objectives

Known False Positives

Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate.

Reference

Test Dataset

version: 6

Attempt To Stop Security Service

This search looks for attempts to stop security-related services on the endpoint.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1562.001
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
|lookup security_services_lookup service as process OUTPUTNEW category, description 
| search category=security 
| `attempt_to_stop_security_service_filter`

Associated Analytic Story

  • Disabling Security Tools

How To Implement

You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. The search is shipped with a lookup file, security_services.csv, that can be edited to update the list of services to monitor. This lookup file can be edited directly where it lives in $SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups, or via the Splunk console. You should add the names of services an attacker might use on the command line and surround with asterisks (*****), so that they work properly when searching the command line. The file should be updated with the names of any services you would like to monitor for attempts to stop the service.,

Required field

ATT&CK

ID Technique Tactic
T1562.001 Disable or Modify Tools Defense Evasion

Kill Chain Phase

  • Installation

  • Actions on Objectives

Known False Positives

None identified. Attempts to disable security-related services should be identified and understood.

Reference

Test Dataset

version: 3

Attempted Credential Dump From Registry via Reg exe

Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.002
  • Last Updated: 2019-12-02
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `attempted_credential_dump_from_registry_via_reg_exe_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1003.002 Security Account Manager Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 4

Attempted Credential Dump From Registry via Reg exe

Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-6-04
details

Search

 
| from read_ssa_enriched_events() 
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) 
| where process_name="cmd.exe" OR process_name="reg.exe" 
| where cmd_line != null  AND match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) 
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints.

Required field

  • process_name

  • _time

  • dest_device_id

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

BCDEdit Failure Recovery Modification

This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1490
  • Last Updated: 2020-12-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `bcdedit_failure_recovery_modification_filter`

Associated Analytic Story

  • Ryuk Ransomware

  • Ransomware

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.

Required field

ATT&CK

ID Technique Tactic
T1490 Inhibit System Recovery Impact

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators may modify the boot configuration.

Reference

Test Dataset

version: 1

Batch File Write to System32

The search looks for a batch file (.bat) written to the Windows system directory tree.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1204.002
  • Last Updated: 2018-12-14
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)`
| rex field=file_name "(?<file_extension>\.[^\.]+)$" 
| search file_path=*system32* AND file_extension=.bat 
| `batch_file_write_to_system32_filter`

Associated Analytic Story

  • SamSam Ransomware

How To Implement

You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic
T1204.002 Malicious File Execution

Kill Chain Phase

  • Delivery

Known False Positives

It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.

Reference

Test Dataset

version: 1

Certutil exe certificate extraction

This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK:
  • Last Updated: 2021-01-26
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `certutil_exe_certificate_extraction_filter`

Associated Analytic Story

  • Windows Persistence Techniques

  • Cloud Federated Credential Abuse

How To Implement

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Installation

Known False Positives

Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.

Reference

Test Dataset

version: 1

Cloud API Calls From Previously Unseen User Roles

This search looks for new commands from each user role.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078
  • Last Updated: 2020-09-04
details

Search


| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object 
| `drop_dm_object_name("All_Changes")` 
| lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenUserApiCall=min(firstTimeSeen) 
| where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") 
| table firstTime, user, object, command 
|`security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `cloud_api_calls_from_previously_unseen_user_roles_filter`

Associated Analytic Story

  • Suspicious Cloud User Activities

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud API Calls Per User Role - Initial to build the initial table of user roles, commands, and times. You must also enable the second baseline search Previously Seen Cloud API Calls Per User Role - Update to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the cloud_api_calls_from_previously_unseen_user_roles_activity_window macro. You can also provide additional filtering for this search by customizing the cloud_api_calls_from_previously_unseen_user_roles_filter

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

.

Reference

Test Dataset

version: 1

Cloud Compute Instance Created By Previously Unseen User

This search looks for cloud compute instances created by users who have not created them before.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.004
  • Last Updated: 2020-08-21
details

Search


| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region 
| `drop_dm_object_name("All_Changes")` 
| lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenUser=min(firstTimeSeen) 
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") 
| table firstTime, user, dest, count vendor_region 
| `security_content_ctime(firstTime)` 
| `cloud_compute_instance_created_by_previously_unseen_user_filter`

Associated Analytic Story

  • Cloud Cryptomining

How To Implement

You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.

Required field

ATT&CK

ID Technique Tactic
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.

Reference

Test Dataset

version: 1

Cloud Compute Instance Created In Previously Unused Region

This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1535
  • Last Updated: 2020-09-02
details

Search


| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user 
| `drop_dm_object_name("All_Changes")` 
| lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenRegion=min(firstTimeSeen) 
| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") 
| table firstTime, user, dest, count , vendor_region 
| `security_content_ctime(firstTime)` 
| `cloud_compute_instance_created_in_previously_unused_region_filter`

Associated Analytic Story

  • Cloud Cryptomining

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Regions - Initial to build the initial table of images observed and times. You must also enable the second baseline search Previously Seen Cloud Regions - Update to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the cloud_compute_instance_created_in_previously_unused_region_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1535 Unused/Unsupported Cloud Regions Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.

Reference

Test Dataset

version: 1

Cloud Compute Instance Created With Previously Unseen Image

This search looks for cloud compute instances being created with previously unseen image IDs.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK:
  • Last Updated: 2018-10-12
details

Search


| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user 
| `drop_dm_object_name("All_Changes")` 
| `drop_dm_object_name("Instance_Changes")` 
| where image_id != "unknown" 
| lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenImage=min(firstTimeSeen) 
| where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h") 
| table firstTime, user, image_id, count, dest 
| `security_content_ctime(firstTime)` 
| `cloud_compute_instance_created_with_previously_unseen_image_filter`

Associated Analytic Story

  • Cloud Cryptomining

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Compute Images - Initial to build the initial table of images observed and times. You must also enable the second baseline search Previously Seen Cloud Compute Images - Update to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the cloud_compute_instance_created_with_previously_unseen_image_filter macro.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

Known False Positives

After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user.

Reference

Test Dataset

version: 1

Cloud Compute Instance Created With Previously Unseen Instance Type

Find EC2 instances being created with previously unseen instance types.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK:
  • Last Updated: 2020-09-12
details

Search


| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user 
| `drop_dm_object_name("All_Changes")` 
| `drop_dm_object_name("Instance_Changes")` 
| where instance_type != "unknown" 
| lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenInstanceType=min(firstTimeSeen) 
| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") 
| table firstTime, user, dest, count, instance_type 
| `security_content_ctime(firstTime)` 
| `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`

Associated Analytic Story

  • Cloud Cryptomining

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Compute Instance Types - Initial to build the initial table of instance types observed and times. You must also enable the second baseline search Previously Seen Cloud Compute Instance Types - Update to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the cloud_compute_instance_created_with_previously_unseen_instance_type_filter macro.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

Known False Positives

It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.

Reference

Test Dataset

version: 1

Cloud Instance Modified By Previously Unseen User

This search looks for cloud instances being modified by users who have not previously modified them.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.004
  • Last Updated: 2020-07-29
details

Search


| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user 
| `drop_dm_object_name("All_Changes")` 
| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenUser=min(firstTimeSeen) 
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") 
| table firstTime user command object_id count 
| `security_content_ctime(firstTime)` 
| `cloud_instance_modified_by_previously_unseen_user_filter`

Associated Analytic Story

  • Suspicious Cloud Instance Activities

How To Implement

This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.

Required field

ATT&CK

ID Technique Tactic
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.

Reference

Test Dataset

version: 1

Cloud Provisioning Activity From Previously Unseen City

This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078
  • Last Updated: 2020-10-09
details

Search


| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command 
| `drop_dm_object_name("All_Changes")` 
| iplocation src 
| where isnotnull(City) 
| lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenCity=min(firstTimeSeen) 
| where isnull(firstTimeSeenCity) OR firstTimeSeenCity > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) 
| table firstTime, src, City, user, object, command 
| `cloud_provisioning_activity_from_previously_unseen_city_filter` 
| `security_content_ctime(firstTime)`

Associated Analytic Story

  • Suspicious Cloud Provisioning Activities

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Provisioning Activity Sources - Initial to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search Previously Seen Cloud Provisioning Activity Sources - Update to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the previously_unseen_cloud_provisioning_activity_window macro. You can also provide additional filtering for this search by customizing the cloud_provisioning_activity_from_previously_unseen_city_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
This search will fire any time a new IP address is seen in the GeoIP database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of MaxMind GeoIP that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.

Reference

Test Dataset

version: 1

Cloud Provisioning Activity From Previously Unseen Country

This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078
  • Last Updated: 2020-10-09
details

Search


| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command 
| `drop_dm_object_name("All_Changes")` 
| iplocation src 
| where isnotnull(Country) 
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenCountry=min(firstTimeSeen) 
| where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h") 
| table firstTime, src, Country, user, object, command 
| `cloud_provisioning_activity_from_previously_unseen_country_filter` 
| `security_content_ctime(firstTime)`

Associated Analytic Story

  • Suspicious Cloud Provisioning Activities

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Provisioning Activity Sources - Initial to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search Previously Seen Cloud Provisioning Activity Sources - Update to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the previously_unseen_cloud_provisioning_activity_window macro. You can also provide additional filtering for this search by customizing the cloud_provisioning_activity_from_previously_unseen_country_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
This search will fire any time a new IP address is seen in the GeoIP database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of MaxMind GeoIP that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.

Reference

Test Dataset

version: 1

Cloud Provisioning Activity From Previously Unseen IP Address

This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078
  • Last Updated: 2020-08-16
details

Search


| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command 
| `drop_dm_object_name("All_Changes")` 
| lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenSrc=min(firstTimeSeen) 
| where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) 
| table firstTime, src, user, object_id, command 
| `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` 
| `security_content_ctime(firstTime)`

Associated Analytic Story

  • Suspicious Cloud Provisioning Activities

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Provisioning Activity Sources - Initial to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search Previously Seen Cloud Provisioning Activity Sources - Update to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the previously_unseen_cloud_provisioning_activity_window macro. You can also provide additional filtering for this search by customizing the cloud_provisioning_activity_from_previously_unseen_ip_address_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
This search will fire any time a new IP address is seen in the GeoIP database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of MaxMind GeoIP that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.

Reference

Test Dataset

version: 1

Cloud Provisioning Activity From Previously Unseen Region

This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078
  • Last Updated: 2020-08-16
details

Search


| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command 
| `drop_dm_object_name("All_Changes")` 
| iplocation src 
| where isnotnull(Region) 
| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data 
| eventstats max(enough_data) as enough_data 
| where enough_data=1 
| eval firstTimeSeenRegion=min(firstTimeSeen) 
| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) 
| table firstTime, src, Region, user, object, command 
| `cloud_provisioning_activity_from_previously_unseen_region_filter` 
| `security_content_ctime(firstTime)`

Associated Analytic Story

  • Suspicious Cloud Provisioning Activities

How To Implement

You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search Previously Seen Cloud Provisioning Activity Sources - Initial to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search Previously Seen Cloud Provisioning Activity Sources - Update to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the previously_unseen_cloud_provisioning_activity_window macro. You can also provide additional filtering for this search by customizing the cloud_provisioning_activity_from_previously_unseen_region_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
This search will fire any time a new IP address is seen in the GeoIP database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of MaxMind GeoIP that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.

Reference

Test Dataset

version: 1

Common Ransomware Extensions

The search looks for file modifications with extensions commonly used by Ransomware

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1485
  • Last Updated: 2020-11-09
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)`
| rex field=file_name "(?<file_extension>\.[^\.]+)$" 
| `ransomware_extensions` 
| `common_ransomware_extensions_filter`

Associated Analytic Story

  • SamSam Ransomware

  • Ryuk Ransonware

  • Ransomware

How To Implement

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
This search produces fields (query,query_length,count) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n1. Label: Name, Field: Name\

  1. \
  2. Label: File Extension, Field: file_extension
    Detailed documentation on how to create a new field within Incident Review may be found here: https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

Required field

ATT&CK

ID Technique Tactic
T1485 Data Destruction Impact

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions.

Reference

Test Dataset

version: 4

Common Ransomware Notes

The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1485
  • Last Updated: 2020-11-09
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `ransomware_notes` 
| `common_ransomware_notes_filter`

Associated Analytic Story

  • SamSam Ransomware

  • Ransomware

  • Ryuk Ransomware

How To Implement

You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.

Required field

ATT&CK

ID Technique Tactic
T1485 Data Destruction Impact

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It's possible that a legitimate file could be created with the same name used by ransomware note files.

Reference

Test Dataset

version: 4

Create Remote Thread into LSASS

Detect remote thread creation into LSASS consistent with credential dumping.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1003.001
  • Last Updated: 2019-12-06
details

Search

`sysmon` EventID=8 TargetImage=*lsass.exe 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `create_remote_thread_into_lsass_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise.

Reference

Test Dataset

version: 1

Create local admin accounts using net exe

This search looks for the creation of local administrator accounts using net.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1136.001
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
|`create_local_admin_accounts_using_net_exe_filter`

Associated Analytic Story

  • DHS Report TA18-074A

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1136.001 Local Account Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators often leverage net.exe to create admin accounts.

Reference

Test Dataset

version: 4

Create or delete windows shares using net exe

This search looks for the creation or deletion of hidden shares using net.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1070.005
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| search process=*share* 
| `create_or_delete_windows_shares_using_net_exe_filter`

Associated Analytic Story

  • Hidden Cobra Malware

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1070.005 Network Share Connection Removal Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate.

Reference

Test Dataset

version: 5

Creation of Shadow Copy

Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.003
  • Last Updated: 2019-12-10
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `creation_of_shadow_copy_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1003.003 NTDS Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Legitimate administrator usage of Vssadmin or Wmic will create false positives.

Reference

Test Dataset

version: 1

Creation of Shadow Copy with wmic and powershell

This search detects the use of wmic and Powershell to create a shadow copy.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.003
  • Last Updated: 2019-12-10
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic* OR Processes.process_name=powershell* Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `creation_of_shadow_copy_with_wmic_and_powershell_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1003.003 NTDS Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Legtimate administrator usage of wmic to create a shadow copy.

Reference

Test Dataset

version: 1

Creation of lsass Dump with Taskmgr

Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1003.001
  • Last Updated: 2020-02-03
details

Search

`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename 
| rename Computer as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `creation_of_lsass_dump_with_taskmgr_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.

Reference

Test Dataset

version: 1

Credential Dumping via Copy Command from Shadow Copy

This search detects credential dumping using copy command from a shadow copy.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.003
  • Last Updated: 2019-12-10
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `credential_dumping_via_copy_command_from_shadow_copy_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1003.003 NTDS Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

unknown

Reference

Test Dataset

version: 1

Credential Dumping via Symlink to Shadow Copy

This search detects the creation of a symlink to a shadow copy.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.003
  • Last Updated: 2019-12-10
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `credential_dumping_via_symlink_to_shadow_copy_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1003.003 NTDS Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

unknown

Reference

Test Dataset

version: 1

Credential Extraction indicative of FGDump and CacheDump with s option

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is a newer version of pwdump tool that extracts NTLM and LanMan password hashes from Windows. Cachedump is a publicly-available tool that extracts cached password hashes from a system's registry.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-18
details

Search

 
| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
| where cmd_line != null AND process_name != null AND parent_process_name != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • process_name

  • parent_process_name

  • _time

  • process_path

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction indicative of FGDump and CacheDump with v option

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is a newer version of pwdump tool that extracts NTLM and LanMan password hashes from Windows. Cachedump is a publicly-available tool that extracts cached password hashes from a system's registry.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-18
details

Search

 
| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null) 
| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • process_name

  • _time

  • process_path

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction indicative of Lazagne command line options

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. LaZagne is a tool that extracts various kinds of credentials from a local computer, including account passwords, domain passwords, browser passwords, etc.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003, T1555
  • Last Updated: 2020-10-18
details

Search

 
| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access
T1555 Credentials from Password Stores Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction indicative of use of DSInternals credential conversion modules

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals is a collection of PowerShell modules commonly employed in exploits.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-21
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-UnicodePassword/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • process_name

  • parent_process_name

  • _time

  • process_path

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction indicative of use of DSInternals modules

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals is a collection of PowerShell modules commonly employed in exploits.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-21
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • process_name

  • parent_process_name

  • _time

  • process_path

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction indicative of use of Mimikatz modules

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Mimikatz is a collection of tools and modules commonly employed in Windows exploits.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-21
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction indicative of use of PowerSploit modules

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit is a collection of Microsoft PowerShell modules commonly employed in exploits.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-21
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Credential Extraction native Microsoft debuggers peek into the kernel

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential material directly from memory and process dumps.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-18
details

Search

 
| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
| where cmd_line != null AND parent_process_name != null AND process_name != null  AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • process_name

  • parent_process_name

  • _time

  • dest_device_id

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, using debuggers this way may be indicative of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps.

Reference

Test Dataset

version: 1

Credential Extraction native Microsoft debuggers via z command line option

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential material directly from memory and process dumps.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-18
details

Search

 
| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null) 
| where cmd_line != null AND process_name != null AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • process_name

  • _time

  • dest_device_id

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, using debuggers this way may be indicative of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps.

Reference

Test Dataset

version: 1

Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals

Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit and DSInternals are common exploit APIs offering PowerShell modules for various exploits of Windows and Active Directory environments.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003
  • Last Updated: 2020-10-18
details

Search

 
| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\
|]+/)=true

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1003 OS Credential Dumping Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

DNS Query Length Outliers - MLTK

This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Resolution
  • ATT&CK: T1071.004
  • Last Updated: 2020-01-22
details

Search


| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time values(DNS.src) as src values(DNS.dest) as dest from datamodel=Network_Resolution by DNS.query DNS.record_type 
| search DNS.record_type=* 
|  `drop_dm_object_name(DNS)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| eval query_length = len(query) 
| apply dns_query_pdfmodel threshold=0.01 
| rename "IsOutlier(query_length)" as isOutlier 
| search isOutlier > 0 
| sort -query_length 
| table start_time end_time query record_type count src dest query_length 
| `dns_query_length_outliers___mltk_filter`

Associated Analytic Story

  • Hidden Cobra Malware

  • Suspicious DNS Traffic

  • Command and Control

How To Implement

To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of DNS Query Length - MLTK" must be executed before this detection search, because it builds a machine-learning (ML) model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.
This search produces fields (query,query_length,count) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n1. Label: DNS Query, Field: query\

  1. \
  2. Label: DNS Query Length, Field: query_length\
  3. \
  4. Label: Number of events, Field: count
    Detailed documentation on how to create a new field within Incident Review may be found here: https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

Required field

ATT&CK

ID Technique Tactic
T1071.004 DNS Command and Control

Kill Chain Phase

  • Command and Control

Known False Positives

If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.

Reference

Test Dataset

version: 2

DNS Query Length With High Standard Deviation

This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Resolution
  • ATT&CK: T1048.003
  • Last Updated: 2021-01-18
details

Search


| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query 
|  `drop_dm_object_name("DNS")` 
| eval query_length = len(query) 
| table query query_length record_type count 
| eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
| where query_length>(avg+stdev*2) 
| eval z_score=(query_length-avg)/stdev 
| `dns_query_length_with_high_standard_deviation_filter`

Associated Analytic Story

  • Hidden Cobra Malware

  • Suspicious DNS Traffic

  • Command and Control

How To Implement

To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.

Required field

ATT&CK

ID Technique Tactic
T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration

Kill Chain Phase

  • Command and Control

Known False Positives

It's possible there can be long domain names that are legitimate.

Reference

Test Dataset

version: 3

Deleting Shadow Copies

The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1490
  • Last Updated: 2020-11-09
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow* by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `deleting_shadow_copies_filter`

Associated Analytic Story

  • Windows Log Manipulation

  • SamSam Ransomware

  • Ransomware

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1490 Inhibit System Recovery Impact

Kill Chain Phase

  • Actions on Objectives

Known False Positives

vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare.

Reference

Test Dataset

version: 4

Detect AWS Console Login by New User

This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Authentication
  • ATT&CK:
  • Last Updated: 2020-05-28
details

Search


| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user 
| `drop_dm_object_name(Authentication)` 
| inputlookup append=t previously_seen_users_console_logins 
| stats min(firstTime) as firstTime max(lastTime) as lastTime by user 
| eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"), "First Time Logging into AWS Console", "Previously Seen User") 
|where userStatus="First Time Logging into AWS Console" 
|  `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `detect_aws_console_login_by_new_user_filter`

Associated Analytic Story

  • Suspicious Cloud Authentication Activities

How To Implement

You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the Previously Seen Users in CloudTrail - Initial support search only once to create a baseline of previously seen IAM users within the last 30 days. Run Previously Seen Users in CloudTrail - Update hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Actions on Objectives

Known False Positives

When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.

Reference

Test Dataset

version: 1

Detect AWS Console Login by User from New City

This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Authentication
  • ATT&CK: T1535
  • Last Updated: 2020-10-07
details

Search


| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
| iplocation Authentication.src 
| `drop_dm_object_name(Authentication)` 
| table firstTime lastTime user City 
| join user  type=outer [
| inputlookup previously_seen_users_console_logins 
| stats earliest(firstTime) AS earliestseen by user City 
| fields earliestseen user City] 
| eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") 
| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") 
| where userCity = "New City" AND userStatus != "Old User" 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| table firstTime lastTime user City  userStatus userCity  
| `detect_aws_console_login_by_user_from_new_city_filter`

Associated Analytic Story

  • Suspicious AWS Login Activities

  • Suspicious Cloud Authentication Activities

How To Implement

You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the Previously Seen Users in CloudTrail - Initial support search only once to create a baseline of previously seen IAM users within the last 30 days. Run Previously Seen Users in CloudTrail - Update hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the detect_aws_console_login_by_user_from_new_city_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1535 Unused/Unsupported Cloud Regions Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.

Reference

Test Dataset

version: 1

Detect AWS Console Login by User from New Country

This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Authentication
  • ATT&CK: T1535
  • Last Updated: 2020-10-07
details

Search


| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
| iplocation Authentication.src 
| `drop_dm_object_name(Authentication)` 
| table firstTime lastTime user Country 
| join user  type=outer [
| inputlookup previously_seen_users_console_logins 
| stats earliest(firstTime) AS earliestseen by user Country 
| fields earliestseen user Country] 
| eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") 
| eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") 
| where userCountry = "New Country" AND userStatus != "Old User" 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| table firstTime lastTime user Country  userStatus userCountry  
| `detect_aws_console_login_by_user_from_new_country_filter`

Associated Analytic Story

  • Suspicious AWS Login Activities

  • Suspicious Cloud Authentication Activities

How To Implement

You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the Previously Seen Users in CloudTrail - Initial support search only once to create a baseline of previously seen IAM users within the last 30 days. Run Previously Seen Users in CloudTrail - Update hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the detect_aws_console_login_by_user_from_new_country_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1535 Unused/Unsupported Cloud Regions Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.

Reference

Test Dataset

version: 1

Detect AWS Console Login by User from New Region

This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour

  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Authentication
  • ATT&CK: T1535
  • Last Updated: 2020-10-07
details

Search


| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
| iplocation Authentication.src 
| `drop_dm_object_name(Authentication)` 
| table firstTime lastTime user Region 
| join user  type=outer [
| inputlookup previously_seen_users_console_logins 
| stats earliest(firstTime) AS earliestseen by user Region 
| fields earliestseen user Region] 
| eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") 
| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") 
| where userRegion = "New Region" AND userStatus != "Old User" 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| table firstTime lastTime user Region  userStatus userRegion  
| `detect_aws_console_login_by_user_from_new_region_filter`

Associated Analytic Story

  • Suspicious AWS Login Activities

  • Suspicious Cloud Authentication Activities

How To Implement

You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the Previously Seen Users in CloudTrail - Initial support search only once to create a baseline of previously seen IAM users within the last 30 days. Run Previously Seen Users in CloudTrail - Update hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the detect_aws_console_login_by_user_from_new_region_filter macro.

Required field

ATT&CK

ID Technique Tactic
T1535 Unused/Unsupported Cloud Regions Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.

Reference

Test Dataset

version: 1

Detect Activity Related to Pass the Hash Attacks

This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1550.002
  • Last Updated: 2020-10-15
details

Search

`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) 
| fillnull 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_activity_related_to_pass_the_hash_attacks_filter`

Associated Analytic Story

  • Lateral Movement

How To Implement

To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows.

Required field

ATT&CK

ID Technique Tactic
T1550.002 Pass the Hash Defense Evasion, Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.

Reference

Test Dataset

version: 5

Detect Computer Changed with Anonymous Account

This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1210
  • Last Updated: 2020-09-18
details

Search

`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3 
| stats count values(host) as host, values(TargetDomainName) as Domain, values(user) as user 
| `detect_computer_changed_with_anonymous_account_filter`

Associated Analytic Story

  • Detect Zerologon Attack

How To Implement

This search requires audit computer account management to be enabled on the system in order to generate Event ID 4742. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Event Logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Required field

ATT&CK

ID Technique Tactic
T1210 Exploitation of Remote Services Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None thus far found

Reference

Test Dataset

version: 1

Detect Credential Dumping through LSASS access

This search looks for reading lsass memory consistent with credential dumping.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1003.001
  • Last Updated: 2019-12-03
details

Search

`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_credential_dumping_through_lsass_access_filter`

Associated Analytic Story

  • Credential Dumping

  • Detect Zerologon Attack

How To Implement

This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.

Reference

Test Dataset

version: 3

Detect Dump LSASS Memory using comsvcs

This search detects the memory of lsass.exe being dumped for offline credential theft attack.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1003.003
  • Last Updated: 2020-09-15
details

Search


| from read_ssa_enriched_events() 
| eval tenant=ucast(map_get(input_event, "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) 
| where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true 
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with Event Code 4688 on the attack_range.

Required field

  • process_name

  • _tenant

  • _time

  • dest_device_id

  • process

ATT&CK

ID Technique Tactic
T1003.003 NTDS Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Detect Excessive Account Lockouts From Endpoint

This search identifies endpoints that have caused a relatively high number of account lockouts in a short period.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.002
  • Last Updated: 2020-11-09
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest All_Changes.result 
|`drop_dm_object_name("All_Changes")` 
|`drop_dm_object_name("Account_Management")`
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| search count > 5 
| `detect_excessive_account_lockouts_from_endpoint_filter`

Associated Analytic Story

  • Account Monitoring and Controls

How To Implement

You must ingest your Windows security event logs in the Change datamodel under the nodename is Account_Management, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.
Splunk>Phantom Playbook Integration
If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/).\

Required field

ATT&CK

ID Technique Tactic
T1078.002 Domain Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.

Reference

Test Dataset

version: 5

Detect Excessive User Account Lockouts

This search detects user accounts that have been locked out a relatively high number of times in a short period.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1078.003
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.user All_Changes.result 
|`drop_dm_object_name("All_Changes")` 
|`drop_dm_object_name("Account_Management")`
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| search count > 5 
| `detect_excessive_user_account_lockouts_filter`

Associated Analytic Story

  • Account Monitoring and Controls

How To Implement

ou must ingest your Windows security event logs in the Change datamodel under the nodename is Account_Management, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.

Required field

ATT&CK

ID Technique Tactic
T1078.003 Local Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.

Reference

Test Dataset

version: 3

Detect GCP Storage access from a new IP

This search looks at GCP Storage bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed a GCP Storage bucket.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1530
  • Last Updated: 2020-08-10
details

Search

`google_gcp_pubsub_message` 
| multikv 
| rename sc_status_ as status 
| rename cs_object_ as bucket_name 
| rename c_ip_ as remote_ip 
| rename cs_uri_ as request_uri 
| rename cs_method_ as operation 
| search status="\"200\"" 
| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri 
| table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri 
| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv 
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri 
| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv 
| eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) 
| where newIP=1 
| eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") 
| eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") 
| table  first_time last_time bucket_name remote_ip operation request_uri 
| `detect_gcp_storage_access_from_a_new_ip_filter`

Associated Analytic Story

  • Suspicious GCP Storage Activities

How To Implement

This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs. These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour. It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *). A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets.

Required field

ATT&CK

ID Technique Tactic
T1530 Data from Cloud Storage Object Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours.

Reference

Test Dataset

version: 1

Detect HTML Help Renamed

The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.001
  • Last Updated: 2021-02-11
details

Search

`sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_html_help_renamed_filter`

Associated Analytic Story

  • Suspicious Compiled HTML Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed hh.exe may be used.

Required field

ATT&CK

ID Technique Tactic
T1218.001 Compiled HTML File Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.

Reference

Test Dataset

version: 1

Detect HTML Help Spawn Child Process

The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.001
  • Last Updated: 2021-02-11
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_html_help_spawn_child_process_filter`

Associated Analytic Story

  • Suspicious Compiled HTML Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.001 Compiled HTML File Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed.

Reference

Test Dataset

version: 1

Detect HTML Help URL in Command Line

The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.001
  • Last Updated: 2021-02-11
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process=*http* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_html_help_url_in_command_line_filter`

Associated Analytic Story

  • Suspicious Compiled HTML Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.001 Compiled HTML File Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed.

Reference

Test Dataset

version: 1

Detect HTML Help Using InfoTech Storage Handlers

The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.001
  • Last Updated: 2021-02-11
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_html_help_using_infotech_storage_handlers_filter`

Associated Analytic Story

  • Suspicious Compiled HTML Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.001 Compiled HTML File Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed.

Reference

Test Dataset

version: 1

Detect IPv6 Network Infrastructure Threats

By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1200, T1498, T1557.002
  • Last Updated: 2020-10-28
details

Search

`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") 
| eval src_interface=src_int_prefix_long+src_int_suffix 
| eval dest_interface=dest_int_prefix_long+dest_int_suffix 
| stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface 
| table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count 
| `security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `detect_ipv6_network_infrastructure_threats_filter`

Associated Analytic Story

  • Router and Infrastructure Security

How To Implement

This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with one or more First Hop Security measures such as RA Guard, DHCP Guard and/or device tracking. See References for more information. The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.

Required field

ATT&CK

ID Technique Tactic
T1200 Hardware Additions Initial Access
T1498 Network Denial of Service Impact
T1557.002 ARP Cache Poisoning Collection, Credential Access

Kill Chain Phase

  • Reconnaissance

  • Delivery

  • Actions on Objectives

Known False Positives

None currently known

Reference

Test Dataset

version: 1

Detect Kerberoasting

This search detects a potential kerberoasting attack via service principal name requests

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1558.003
  • Last Updated: 2020-10-21
details

Search

 
| from read_ssa_enriched_events() 
| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id") 
| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" 
| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] 
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID 
| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" 
| select start_time, end_time, entities, body 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2

Required field

  • service_name

  • _time

  • event_code

  • ticket_encryption_type

  • service_id

  • ticket_options

ATT&CK

ID Technique Tactic
T1558.003 Kerberoasting Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Older systems that support kerberos RC4 by default NetApp may generate false positives

Reference

  • Initial ESCU implementation by Jose Hernandez and Patrick Bareiss

Test Dataset

version: 1

Detect Large Outbound ICMP Packets

This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1095
  • Last Updated: 2018-06-01
details

Search


| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) values(All_Traffic.bytes) from datamodel=Network_Traffic where All_Traffic.action !=blocked All_Traffic.dest_category !=internal (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) All_Traffic.bytes > 1000 by All_Traffic.src_ip All_Traffic.dest_ip 
| `drop_dm_object_name("All_Traffic")` 
| search ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` 
| `detect_large_outbound_icmp_packets_filter`

Associated Analytic Story

  • Command and Control

How To Implement

In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able to distinguish internal from external address space. Add a category named internal to the CIDRs that host the company's assets in the assets_by_cidr.csv lookup file, which is located in $SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model

Required field

ATT&CK

ID Technique Tactic
T1095 Non-Application Layer Protocol Command and Control

Kill Chain Phase

  • Command and Control

Known False Positives

ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with command and control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro detect_large_outbound_icmp_packets_filter to adjust the byte threshold or add specific IP addresses to an allow list.

Reference

Test Dataset

version: 2

Detect MSHTA Url in Command Line

This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.005
  • Last Updated: 2021-01-20
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_mshta_url_in_command_line_filter`

Associated Analytic Story

  • Suspicious MSHTA Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.005 Mshta Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

It is possible legitimate applications may perform this behavior and will need to be filtered.

Reference

Test Dataset

version: 1

Detect New Local Admin account

This search looks for newly created accounts that have been elevated to local administrators.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1136.001
  • Last Updated: 2020-07-08
details

Search

`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) 
| transaction member_id connected=false maxspan=180m 
| rename member_id as user 
| stats count min(_time) as firstTime max(_time) as lastTime by user dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_new_local_admin_account_filter`

Associated Analytic Story

  • DHS Report TA18-074A

How To Implement

You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732

Required field

ATT&CK

ID Technique Tactic
T1136.001 Local Account Persistence

Kill Chain Phase

  • Actions on Objectives

  • Command and Control

Known False Positives

The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives

Reference

Test Dataset

version: 2

Detect New Open GCP Storage Buckets

This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1530
  • Last Updated: 2020-08-05
details

Search

`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions 
| spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action 
| spath output=user path=data.protoPayload.authenticationInfo.principalEmail 
| spath output=location path=data.protoPayload.resourceLocation.currentLocations{} 
| spath output=src path=data.protoPayload.requestMetadata.callerIp 
| spath output=bucketName path=data.protoPayload.resourceName 
| spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role 
| spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member 
| search (member=allUsers AND action=ADD) 
| table  _time, bucketName, src, user, location, action, role, member 
| search `detect_new_open_gcp_storage_buckets_filter`

Associated Analytic Story

  • Suspicious GCP Storage Activities

How To Implement

This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview).

Required field

ATT&CK

ID Technique Tactic
T1530 Data from Cloud Storage Object Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

While this search has no known false positives, it is possible that a GCP admin has legitimately created a public bucket for a specific purpose. That said, GCP strongly advises against granting full control to the "allUsers" group.

Reference

Test Dataset

version: 1

Detect New Open S3 Buckets over AWS CLI

This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1530
  • Last Updated: 2021-01-12
details

Search

`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") 
| rename requestParameters.bucketName AS bucketName 
| fillnull 
| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_new_open_s3_buckets_over_aws_cli_filter`

Associated Analytic Story

  • Suspicious AWS S3 Activities

How To Implement

Required field

ATT&CK

ID Technique Tactic
T1530 Data from Cloud Storage Object Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.

Reference

Test Dataset

version: 1

Detect New Open S3 buckets

This search looks for CloudTrail events where a user has created an open/public S3 bucket.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1530
  • Last Updated: 2021-01-12
details

Search

`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl 
| rex field=_raw "(?<json_field>{.+})" 
| spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} 
| search grantees=* 
| mvexpand grantees 
| spath input=grantees output=uri path=Grantee.URI 
| spath input=grantees output=permission path=Permission 
| search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") 
| search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") 
| rename requestParameters.bucketName AS bucketName 
| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_new_open_s3_buckets_filter`

Associated Analytic Story

  • Suspicious AWS S3 Activities

How To Implement

You must install the AWS App for Splunk.

Required field

ATT&CK

ID Technique Tactic
T1530 Data from Cloud Storage Object Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.

Reference

Test Dataset

version: 2

Detect Outbound SMB Traffic

This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1071.002
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dest_port) as dest_port values(sourcetype) as sourcetype count from datamodel=Network_Traffic where ((All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb") AND NOT (All_Traffic.action="blocked" OR All_Traffic.dest_category="internal" OR All_Traffic.dest_ip=10.0.0.0/8 OR All_Traffic.dest_ip=172.16.0.0/12 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip=100.64.0.0/10)) by All_Traffic.src_ip 
| `drop_dm_object_name("All_Traffic")` 
| `security_content_ctime(start_time)` 
| `security_content_ctime(end_time)` 
| `detect_outbound_smb_traffic_filter`

Associated Analytic Story

  • Hidden Cobra Malware

  • DHS Report TA18-074A

  • Sunburst Malware

How To Implement

In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have good understanding of how your network segments are designed, and be able to distinguish internal from external address space. Add a category named internal to the CIDRs that host the companys assets in assets_by_cidr.csv lookup file, which is located in $SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model

Required field

ATT&CK

ID Technique Tactic
T1071.002 File Transfer Protocols Command and Control

Kill Chain Phase

  • Actions on Objectives

  • Command and Control

Known False Positives

It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company's internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as internal in the lookup file to avoid creating notable events for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary.

Reference

Test Dataset

version: 3

Detect Pass the Hash

This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1550.002
  • Last Updated: 2020-10-21
details

Search

 
| from read_ssa_enriched_events() 
| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact") 
| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") 
| first_time_event input_columns=["EventCode","LogonProcess","ComputerName"] 
| where first_time_EventCode_LogonProcess_ComputerName 
| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" 
| select start_time, end_time, entities, body 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2

Required field

  • logon_process

  • dest_user_primary_artifact

  • _time

  • event_code

  • dest_ip_primary_artifact

  • logon_type

ATT&CK

ID Technique Tactic
T1550.002 Pass the Hash Defense Evasion, Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.

Reference

  • Initial ESCU implementation by Bhavin Patel and Patrick Bareiss

Test Dataset

version: 1

Detect Path Interception By Creation Of program exe

The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1574.009
  • Last Updated: 2020-07-03
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest index 
| `drop_dm_object_name(Processes)` 
| rex field=process "^.*?\\\\(?<service_process>[^\\\\]*\.(?:exe
|bat
|com
|ps1))" 
| eval process_name = lower(process_name) 
| eval service_process = lower(service_process) 
| where process_name != service_process 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_path_interception_by_creation_of_program_exe_filter`

Associated Analytic Story

  • Windows Persistence Techniques

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1574.009 Path Interception by Unquoted Path Defense Evasion, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

unknown

Reference

Test Dataset

version: 3

Detect Port Security Violation

By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1200, T1498, T1557.002
  • Last Updated: 2020-10-28
details

Search

`cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") 
| eval src_interface=src_int_prefix_long+src_int_suffix 
| stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count by host src_interface 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_port_security_violation_filter`

Associated Analytic Story

  • Router and Infrastructure Security

How To Implement

This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with Port Security and Error Disable for this to work (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.

Required field

ATT&CK

ID Technique Tactic
T1200 Hardware Additions Initial Access
T1498 Network Denial of Service Impact
T1557.002 ARP Cache Poisoning Collection, Credential Access

Kill Chain Phase

  • Reconnaissance

  • Delivery

  • Exploitation

  • Actions on Objectives

Known False Positives

This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.

Reference

Test Dataset

version: 1

Detect Prohibited Applications Spawning cmd exe

This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1059.003
  • Last Updated: 2020-11-10
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name Processes.dest Processes.user
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
|search [`prohibited_apps_launching_cmd`] 
| `detect_prohibited_applications_spawning_cmd_exe_filter`

Associated Analytic Story

  • Suspicious Command-Line Executions

  • Suspicious MSHTA Activity

  • Suspicious Zoom Child Processes

  • Sunburst Malware

How To Implement

You must be ingesting data that records process activity from your hosts and populates the Endpoint data model with the resultant dataset. This search includes a lookup file, prohibited_apps_launching_cmd.csv, that contains a list of processes that should not be spawning cmd.exe. You can modify this lookup to better suit your environment.

Required field

ATT&CK

ID Technique Tactic
T1059.003 Windows Command Shell Execution

Kill Chain Phase

  • Exploitation

Known False Positives

There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate.

Reference

Test Dataset

version: 5

Detect Prohibited Applications Spawning cmd exe

This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule Detect Prohibited Applications Spawning cmd.exe by @bpatel.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1059
  • Last Updated: 2020-7-13
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)

| where process_name="cmd.exe" 
| rex field=parent_process "(?<field0>[^\\\\]+)$" 
| where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" OR field0="java.exe" OR field0="powershell.exe"

| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body="TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP.

Required field

  • process_name

  • parent_process_name

  • _time

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1059 Command and Scripting Interpreter Execution

Kill Chain Phase

  • Exploitation

Known False Positives

There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate.

Reference

Test Dataset

version: 1

Detect PsExec With accepteula Flag

This search looks for events where PsExec.exe is run with the accepteula flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument accepteula within the command line.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1021.002
  • Last Updated: 2020-11-10
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest  Processes.parent_process_name 
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_psexec_with_accepteula_flag_filter`

Associated Analytic Story

  • SamSam Ransomware

  • DHS Report TA18-074A

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators can leverage PsExec for accessing remote systems and might pass accepteula as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine

Reference

Test Dataset

version: 3

Detect Rare Executables

This search will return a table of rare processes, the names of the systems running them, and the users who initiated each process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK:
  • Last Updated: 2020-03-16
details

Search


| tstats `security_content_summariesonly` count values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name  
| rename Processes.process_name as process 
| rex field=user "(?<user_domain>.*)\\\\(?<user_name>.*)" 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| search [
| tstats count from datamodel=Endpoint.Processes by Processes.process_name 
| rare Processes.process_name limit=30 
| rename Processes.process_name as process
| `filter_rare_process_allow_list`
| table process ] 
| `detect_rare_executables_filter`

Associated Analytic Story

  • Emotet Malware DHS Report TA18-201A

  • Unusual Processes

  • Cloud Federated Credential Abuse

How To Implement

To successfully implement this search, you must be ingesting data that records process activity from your hosts and populating the endpoint data model with the resultant dataset. The macro filter_rare_process_allow_list searches two lookup files for allowed processes. These consist of rare_process_allow_list_default.csv and rare_process_allow_list_local.csv. To add your own processes to the allow list, add them to rare_process_allow_list_local.csv. If you wish to remove an entry from the default lookup file, you will have to modify the macro itself to set the allow_list value for that process to false. You can modify the limit parameter and search scheduling to better suit your environment.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Installation

  • Command and Control

  • Actions on Objectives

Known False Positives

Some legitimate processes may be only rarely executed in your environment. As these are identified, update rare_process_allow_list_local.csv to filter them out of your search results.

Reference

Test Dataset

version: 5

Detect Regasm Spawning a Process

The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.009
  • Last Updated: 2021-02-12
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_regasm_spawning_a_process_filter`

Associated Analytic Story

  • Suspicious Regsvcs Regasm Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.009 Regsvcs/Regasm Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.

Reference

Test Dataset

version: 1

Detect Regasm with Network Connection

The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.009
  • Last Updated: 2021-02-16
details

Search

`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe 
| rename Computer as dest 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_regasm_with_network_connection_filter`

Associated Analytic Story

  • Suspicious Regsvcs Regasm Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.009 Regsvcs/Regasm Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.

Reference

Test Dataset

version: 1

Detect Regasm with no Command Line Arguments

The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.009
  • Last Updated: 2021-02-12
details

Search

`sysmon` EventID=1 (process_name=regasm.exe OR OriginalFileName=RegAsm.exe) 
| regex CommandLine="(regasm\.exe.{0,4}$)" 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_regasm_with_no_command_line_arguments_filter`

Associated Analytic Story

  • Suspicious Regsvcs Regasm Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.009 Regsvcs/Regasm Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.

Reference

Test Dataset

version: 1

Detect Regsvcs Spawning a Process

The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.009
  • Last Updated: 2021-02-12
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_regsvcs_spawning_a_process_filter`

Associated Analytic Story

  • Suspicious Regsvcs Regasm Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.009 Regsvcs/Regasm Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.

Reference

Test Dataset

version: 1

Detect Regsvcs with Network Connection

The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.009
  • Last Updated: 2021-02-16
details

Search

`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
| rename Computer as dest 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_regsvcs_with_network_connection_filter`

Associated Analytic Story

  • Suspicious Regsvcs Regasm Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.009 Regsvcs/Regasm Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.

Reference

Test Dataset

version: 1

Detect Regsvcs with No Command Line Arguments

The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.009
  • Last Updated: 2021-02-12
details

Search

`sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvcs.exe) 
| regex CommandLine="(regsvcs\.exe.{0,4}$)" 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_regsvcs_with_no_command_line_arguments_filter`

Associated Analytic Story

  • Suspicious Regsvcs Regasm Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.009 Regsvcs/Regasm Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.

Reference

Test Dataset

version: 1

Detect Regsvr32 Application Control Bypass

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack.
Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.010
  • Last Updated: 2021-01-28
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_regsvr32_application_control_bypass_filter`

Associated Analytic Story

  • Suspicious Regsvr32 Activity

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe.

Required field

ATT&CK

ID Technique Tactic
T1218.010 Regsvr32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Limited false positives related to third party software registering .DLL's.

Reference

Test Dataset

version: 1

Detect Rogue DHCP Server

By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack).

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1200, T1498, T1557
  • Last Updated: 2020-08-11
details

Search

`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" 
| stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)`
| `detect_rogue_dhcp_server_filter`

Associated Analytic Story

  • Router and Infrastructure Security

How To Implement

This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping enabled (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.

Required field

ATT&CK

ID Technique Tactic
T1200 Hardware Additions Initial Access
T1498 Network Denial of Service Impact
T1557 Man-in-the-Middle Collection, Credential Access

Kill Chain Phase

  • Reconnaissance

  • Delivery

  • Actions on Objectives

Known False Positives

This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface.

Reference

Test Dataset

version: 1

Detect Rundll32 Application Control Bypass - advpack

The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.011
  • Last Updated: 2021-02-04
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_rundll32_application_control_bypass___advpack_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive.

Reference

Test Dataset

version: 1

Detect Rundll32 Application Control Bypass - setupapi

The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.011
  • Last Updated: 2021-02-04
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_rundll32_application_control_bypass___setupapi_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use setupapi triggering a false positive.

Reference

Test Dataset

version: 1

Detect Rundll32 Application Control Bypass - syssetup

The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.011
  • Last Updated: 2021-02-04
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `detect_rundll32_application_control_bypass___syssetup_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive.

Reference

Test Dataset

version: 1

Detect Rundll32 Inline HTA Execution

The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.005
  • Last Updated: 2021-01-20
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_rundll32_inline_hta_execution_filter`

Associated Analytic Story

  • Suspicious MSHTA Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.005 Mshta Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.

Reference

Test Dataset

version: 1

Detect S3 access from a new IP

This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1530
  • Last Updated: 2018-06-28
details

Search

`aws_s3_accesslogs` http_status=200  [search `aws_s3_accesslogs` http_status=200 
| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip 
| inputlookup append=t previously_seen_S3_access_from_remote_ip.csv 
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip 
| outputlookup previously_seen_S3_access_from_remote_ip.csv 
| eval newIP=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) 
| where newIP=1 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| table bucket_name remote_ip]
| iplocation remote_ip 
|rename remote_ip as src_ip 
| table _time bucket_name src_ip City Country operation request_uri 
| `detect_s3_access_from_a_new_ip_filter`

Associated Analytic Story

  • Suspicious AWS S3 Activities

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names.

Required field

ATT&CK

ID Technique Tactic
T1530 Data from Cloud Storage Object Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour

Reference

Test Dataset

version: 1

Detect SNICat SNI Exfiltration

This search looks for commands that the SNICat tool uses in the TLS SNI field.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1041
  • Last Updated: 2020-10-21
details

Search

`zeek_ssl` 
| rex field=server_name "(?<snicat>(LIST
|LS
|SIZE
|LD
|CB
|CD
|EX
|ALIVE
|EXIT
|WHERE
|finito)-[A-Za-z0-9]{16}\.)" 
| stats count by src_ip dest_ip server_name snicat 
| where count>0 
| table src_ip dest_ip server_name snicat 
| `detect_snicat_sni_exfiltration_filter`

Associated Analytic Story

  • Data Exfiltration

How To Implement

You must be ingesting Zeek SSL data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting when any of the predefined SNICat commands are found within the server_name (SNI) field. These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito. You can go further once this has been detected, and run other searches to decode the SNI data to prove or disprove if any data exfiltration has taken place.

Required field

ATT&CK

ID Technique Tactic
T1041 Exfiltration Over C2 Channel Exfiltration

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Unknown

Reference

Test Dataset

version: 1

Detect Software Download To Network Device

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1542.005
  • Last Updated: 2020-10-28
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.transport=udp AND All_Traffic.dest_port=69) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch by All_Traffic.src All_Traffic.dest All_Traffic.dest_port 
| `drop_dm_object_name("All_Traffic")` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_software_download_to_network_device_filter`

Associated Analytic Story

  • Router and Infrastructure Security

How To Implement

This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory.

Required field

ATT&CK

ID Technique Tactic
T1542.005 TFTP Boot Defense Evasion, Persistence

Kill Chain Phase

  • Delivery

Known False Positives

This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices.

Reference

Test Dataset

version: 1

Detect Spike in AWS Security Hub Alerts for EC2 Instance

This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2021-01-26
details

Search

`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance 
| bucket span=4h _time 
| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest 
| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev 
| eval threshold_value = 3 
| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) 
| search isOutlier=1 
| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg 
| `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`

Associated Analytic Story

  • AWS Security Hub Alerts

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

Known False Positives

None

Reference

Test Dataset

version: 3

Detect Spike in AWS Security Hub Alerts for User

This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2021-01-26
details

Search

`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser 
| rename findings{}.Resources{}.Id as user 
| bucket span=4h _time 
| stats count AS alerts by _time user 
| eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev 
| eval threshold_value = 2 
| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0) 
| search isOutlier=1 
| table _time user alerts 
|`detect_spike_in_aws_security_hub_alerts_for_user_filter`

Associated Analytic Story

  • AWS Security Hub Alerts

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

Known False Positives

None

Reference

Test Dataset

version: 3

Detect Spike in S3 Bucket deletion

This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1530
  • Last Updated: 2018-11-27
details

Search

`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=DeleteBucket 
| spath output=arn path=userIdentity.arn 
| stats count as apiCalls by arn 
| inputlookup s3_deletion_baseline append=t 
| fields - latestCount 
| stats values(*) as * by arn 
| rename apiCalls as latestCount 
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 
| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) 
| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) 
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls 
| outputlookup s3_deletion_baseline 
| eval dataPointThreshold = 15, deviationThreshold = 3 
| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) 
| where isSpike=1 
| rename arn as userIdentity.arn 
| table userIdentity.arn] 
| spath output=user userIdentity.arn 
| spath output=bucketName path=requestParameters.bucketName 
| stats values(bucketName) as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user 
| `detect_spike_in_s3_bucket_deletion_filter`

Associated Analytic Story

  • Suspicious AWS S3 Activities

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify dataPointThreshold and deviationThreshold to better fit your environment. The dataPointThreshold variable is the minimum number of data points required to have a statistically significant amount of data to determine. The deviationThreshold variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity.

Required field

ATT&CK

ID Technique Tactic
T1530 Data from Cloud Storage Object Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Based on the values ofdataPointThreshold and deviationThreshold, the false positive rate may vary. Please modify this according the your environment.

Reference

Test Dataset

version: 1

Detect Spike in blocked Outbound Traffic from your AWS

This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2018-05-07
details

Search

`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)  [search  `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)  
| stats count as numberOfBlockedConnections by src_ip 
| inputlookup baseline_blocked_outbound_connections append=t 
| fields - latestCount 
| stats values(*) as * by src_ip 
| rename numberOfBlockedConnections as latestCount 
| eval newAvgBlockedConnections=avgBlockedConnections + (latestCount-avgBlockedConnections)/720 
| eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) 
| eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) 
| table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections 
| outputlookup baseline_blocked_outbound_connections 
| eval dataPointThreshold = 5, deviationThreshold = 3 
| eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) AND numDataPoints > dataPointThreshold, 1, 0) 
| where isSpike=1 
| table src_ip] 
| stats values(dest_ip) as "Blocked Destination IPs", values(interface_id) as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections by src_ip 
| `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter`

Associated Analytic Story

  • AWS Network ACL Activity

  • Suspicious AWS Traffic

  • Command and Control

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow logs. You can modify dataPointThreshold and deviationThreshold to better fit your environment. The dataPointThreshold variable is the number of data points required to meet the definition of "spike." The deviationThreshold variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Blocked Outbound Connection" support search once to create a history of previously seen blocked outbound connections.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Actions on Objectives

  • Command and Control

Known False Positives

The false-positive rate may vary based on the values ofdataPointThreshold and deviationThreshold. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections.

Reference

Test Dataset

version: 1

Detect Traffic Mirroring

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1200, T1498, T1020.001
  • Last Updated: 2020-10-28
details

Search

`cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") 
| stats min(_time) AS firstTime max(_time) AS lastTime count BY host facility mnemonic 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` 
| `detect_traffic_mirroring_filter`

Associated Analytic Story

  • Router and Infrastructure Security

How To Implement

This search uses a standard SPL query on logs from Cisco Network devices. The network devices must log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. Also note that an attacker may disable logging from the device prior to enabling traffic mirroring.

Required field

ATT&CK

ID Technique Tactic
T1200 Hardware Additions Initial Access
T1498 Network Denial of Service Impact
T1020.001 Traffic Duplication Exfiltration

Kill Chain Phase

  • Delivery

  • Actions on Objectives

Known False Positives

This search will return false positives for any legitimate traffic captures by network administrators.

Reference

Test Dataset

version: 1

Detect Unauthorized Assets by MAC address

By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Sessions
  • ATT&CK:
  • Last Updated: 2017-09-13
details

Search


| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac 
| dedup All_Sessions.dest_mac
| `drop_dm_object_name("Network_Sessions")`
|`drop_dm_object_name("All_Sessions")` 
| search NOT [
| inputlookup asset_lookup_by_str 
|rename mac as dest_mac 
| fields + dest_mac] 
| `detect_unauthorized_assets_by_mac_address_filter`

Associated Analytic Story

  • Asset Tracking

How To Implement

This search uses the Network_Sessions data model shipped with Enterprise Security. It leverages the Assets and Identity framework to populate the assets_by_str.csv file located in SA-IdentityManagement, which will contain a list of known authorized organizational assets including their MAC addresses. Ensure that all inventoried systems have their MAC address populated.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Reconnaissance

  • Delivery

  • Actions on Objectives

Known False Positives

This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information.

Reference

Test Dataset

version: 1

Detect Use of cmd exe to Launch Script Interpreters

This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1059.003
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name Processes.user Processes.dest 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` 
| `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`

Associated Analytic Story

  • Emotet Malware DHS Report TA18-201A

  • Suspicious Command-Line Executions

How To Implement

To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1059.003 Windows Command Shell Execution

Kill Chain Phase

  • Exploitation

Known False Positives

Some legitimate applications may exhibit this behavior.

Reference

Test Dataset

version: 4

Detect Windows DNS SIGRed via Splunk Stream

This search detects SIGRed via Splunk Stream.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1203
  • Last Updated: 2020-07-28
details

Search

`stream_dns` 
| spath "query_type{}" 
| search "query_type{}" IN (SIG,KEY) 
| spath protocol_stack 
| search protocol_stack="ip:tcp:dns" 
| append [search `stream_tcp` bytes_out>65000] 
| `detect_windows_dns_sigred_via_splunk_stream_filter` 
| stats count by flow_id 
| where count>1 
| fields - count

Associated Analytic Story

  • Windows DNS SIGRed CVE-2020-1350

How To Implement

You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size via stream:tcp. Replace the macro definitions ('stream:dns' and 'stream:tcp') with configurations for your Splunk environment.

Required field

ATT&CK

ID Technique Tactic
T1203 Exploitation for Client Execution Execution

Kill Chain Phase

  • Exploitation

Known False Positives

unknown

Reference

Test Dataset

version: 1

Detect Windows DNS SIGRed via Zeek

This search detects SIGRed via Zeek DNS and Zeek Conn data.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Resolution
  • ATT&CK: T1203
  • Last Updated: 2020-07-28
details

Search


| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id 
| rename DNS.flow_id as flow_id 
| append [
| tstats  `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.bytes_in>65000 by All_Traffic.flow_id 
| rename All_Traffic.flow_id as flow_id] 
| `detect_windows_dns_sigred_via_zeek_filter` 
| stats count by flow_id 
| where count>1 
| fields - count

Associated Analytic Story

  • Windows DNS SIGRed CVE-2020-1350

How To Implement

You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via bro:conn:json. The Network Resolution and Network Traffic datamodels are in use for this search.

Required field

ATT&CK

ID Technique Tactic
T1203 Exploitation for Client Execution Execution

Kill Chain Phase

  • Exploitation

Known False Positives

unknown

Reference

Test Dataset

version: 1

Detect Zerologon via Zeek

This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1190
  • Last Updated: 2020-09-15
details

Search

`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) 
| bin span=5m _time 
| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount by _time,src_ip,dest_ip 
| search opscount=3 authcount>4 passcount>0 
| search `detect_zerologon_via_zeek_filter`

Associated Analytic Story

  • Detect Zerologon Attack

How To Implement

You must be ingesting Zeek DCE-RPC data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app via bro:rpc:json. These three operations are then correlated on the Zeek UID field.

Required field

ATT&CK

ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access

Kill Chain Phase

  • Exploitation

Known False Positives

unknown

Reference

Test Dataset

version: 1

Detect hosts connecting to dynamic domain providers

Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, block lists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Resolution
  • ATT&CK: T1189
  • Last Updated: 2021-01-14
details

Search


| tstats `security_content_summariesonly` count values(DNS.answer) as answer min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host 
| `drop_dm_object_name("DNS")` 
| `security_content_ctime(firstTime)` 
| `dynamic_dns_providers` 
| `detect_hosts_connecting_to_dynamic_domain_providers_filter`

Associated Analytic Story

  • Data Protection

  • Prohibited Traffic Allowed or Protocol Mismatch

  • DNS Hijacking

  • Suspicious DNS Traffic

  • Dynamic DNS

  • Command and Control

How To Implement

First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the Network_Resolution data model. This search also leverages a lookup file, dynamic_dns_providers_default.csv, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of dynamic_dns_providers_local.csv.
This search produces fields (query, answer, isDynDNS) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable event. To see the additional metadata, add the following fields, if not already present, to Incident Review. Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n1. Label: DNS Query, Field: query\

  1. \
  2. Label: DNS Answer, Field: answer\
  3. \
  4. Label: IsDynamicDNS, Field: isDynDNS
    Detailed documentation on how to create a new field within Incident Review may be found here: https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

Required field

ATT&CK

ID Technique Tactic
T1189 Drive-by Compromise Initial Access

Kill Chain Phase

  • Command and Control

  • Actions on Objectives

Known False Positives

Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.

Reference

Test Dataset

version: 3

Detect mshta inline hta execution

The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.005
  • Last Updated: 2021-01-20
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `detect_mshta_inline_hta_execution_filter`

Associated Analytic Story

  • Suspicious MSHTA Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.005 Mshta Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.

Reference

Test Dataset

version: 5

Detect mshta renamed

The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.005
  • Last Updated: 2021-01-20
details

Search

`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe) 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_mshta_renamed_filter`

Associated Analytic Story

  • Suspicious MSHTA Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.005 Mshta Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive.

Reference

Test Dataset

version: 1

Detect processes used for System Network Configuration Discovery

This search looks for fast execution of processes used for system network configuration discovery on the endpoint.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1016
  • Last Updated: 2020-11-10
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `drop_dm_object_name(Processes)` 
| search `system_network_configuration_discovery_tools` 
| transaction dest connected=false maxpause=5m 
|where eventcount>=5 
| table firstTime lastTime dest user process_name process parent_process eventcount 
| `detect_processes_used_for_system_network_configuration_discovery_filter`

Associated Analytic Story

  • Unusual Processes

How To Implement

You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings.

Required field

ATT&CK

ID Technique Tactic
T1016 System Network Configuration Discovery Discovery

Kill Chain Phase

  • Installation

  • Command and Control

  • Actions on Objectives

Known False Positives

It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.

Reference

Test Dataset

version: 2

Disabling Remote User Account Control

The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC).

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1548.002
  • Last Updated: 2020-11-18
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action 
| `drop_dm_object_name(Registry)` 
| `disabling_remote_user_account_control_filter`

Associated Analytic Story

  • Windows Defense Evasion Tactics

  • Suspicious Windows Registry Activities

How To Implement

To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.

Required field

ATT&CK

ID Technique Tactic
T1548.002 Bypass User Account Control Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence.

Reference

Test Dataset

version: 4

Dump LSASS via comsvcs DLL

Detect the usage of comsvcs.dll for dumping the lsass process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.001
  • Last Updated: 2020-02-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `dump_lsass_via_comsvcs_dll_filter`

Associated Analytic Story

  • Credential Dumping

  • Suspicious Rundll32 Activity

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Dump LSASS via procdump

Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe. Modify the query as needed.
During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.001
  • Last Updated: 2021-02-01
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `dump_lsass_via_procdump_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Dump LSASS via procdump Rename

Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.
During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1003.001
  • Last Updated: 2021-02-01
details

Search

`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* 
| rename Computer as dest 
|  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `dump_lsass_via_procdump_rename_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1003.001 LSASS Memory Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Email files written outside of the Outlook directory

The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1114.001
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name=*.pst OR Filesystem.file_name=*.ost) Filesystem.file_path != "C:\\Users\\*\\My Documents\\Outlook Files\\*"  Filesystem.file_path!="C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*" by Filesystem.action Filesystem.process_id Filesystem.file_name Filesystem.dest 
| `drop_dm_object_name("Filesystem")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `email_files_written_outside_of_the_outlook_directory_filter`

Associated Analytic Story

  • Collection and Staging

How To Implement

To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.

Required field

ATT&CK

ID Technique Tactic
T1114.001 Local Email Collection Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.

Reference

Test Dataset

version: 3

Execution of File with Multiple Extensions

This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1036.003
  • Last Updated: 2020-11-18
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by Processes.dest Processes.user Processes.process Processes.parent_process 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `drop_dm_object_name(Processes)` 
| `execution_of_file_with_multiple_extensions_filter`

Associated Analytic Story

  • Windows File Extension and Association Abuse

How To Implement

To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node.

Required field

ATT&CK

ID Technique Tactic
T1036.003 Rename System Utilities Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 3

File with Samsam Extension

The search looks for file writes with extensions consistent with a SamSam ransomware attack.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK:
  • Last Updated: 2018-12-14
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)`
| rex field=file_name "(?<file_extension>\.[^\.]+)$" 
| search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml 
| `file_with_samsam_extension_filter`

Associated Analytic Story

  • SamSam Ransomware

How To Implement

You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Installation

Known False Positives

Because these extensions are not typically used in normal operations, you should investigate all results.

Reference

Test Dataset

version: 1

First Time Seen Child Process of Zoom

This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1068
  • Last Updated: 2020-05-20
details

Search


| tstats `security_content_summariesonly` min(_time) as firstTime values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_id) as parent_process_id values(Processes.process_name) as process_name values(Processes.process) as process from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_id Processes.dest 
| `drop_dm_object_name(Processes)` 
| lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen 
| where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") 
| `security_content_ctime(firstTime)` 
| table firstTime dest, process_id, process_name, parent_process_id, parent_process_name 
|`first_time_seen_child_process_of_zoom_filter`

Associated Analytic Story

  • Suspicious Zoom Child Processes

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You should run the baseline search Previously Seen Zoom Child Processes - Initial to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search Previously Seen Zoom Child Processes - Update to keep this table up to date and to age out old child processes. Please update the previously_seen_zoom_child_processes_window macro to adjust the time window.

Required field

ATT&CK

ID Technique Tactic
T1068 Exploitation for Privilege Escalation Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.

Reference

Test Dataset

version: 1

First time seen command line argument

This search looks for command-line arguments that use a /c parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule First time seen command line argument by @bpatel.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1059, T1117, T1202
  • Last Updated: 2021-2-1
details

Search


| from read_ssa_enriched_events() 
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
| eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s
|$)+)/, "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s
|$)+)/, "\\PATH"), /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\d+/, "N") 
| where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true 
| select cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id 
| first_time_event input_columns=["cmd_line_norm"] 
| where first_time_cmd_line_norm 
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be populating the endpoint data model for SSA and specifically the process_name and the process fields

Required field

  • process_name

  • _time

  • dest_device_id

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1059 Command and Scripting Interpreter Execution
T1202 Indirect Command Execution Defense Evasion

Kill Chain Phase

  • Command and Control

  • Actions on Objectives

Known False Positives

Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the first_time_seen_cmd_line_filter macro to exclude legitimate parent_process_name

Reference

Test Dataset

version: 2

Hiding Files And Directories With Attrib exe

Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1222.001
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user Processes.dest 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)`
| `hiding_files_and_directories_with_attrib_exe_filter`

Associated Analytic Story

  • Windows Defense Evasion Tactics

  • Windows Persistence Techniques

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1222.001 Windows File and Directory Permissions Modification Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Some applications and users may legitimately use attrib.exe to interact with the files.

Reference

Test Dataset

version: 4

High Number of Login Failures from a single source

This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1110.001
  • Last Updated: 2020-12-16
details

Search

`o365_management_activity` Operation=UserLoginFailed  record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory 
| stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app 
| search accounts_locked >= 5
| `high_number_of_login_failures_from_a_single_source_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

Required field

ATT&CK

ID Technique Tactic
T1110.001 Password Guessing Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

unknown

Reference

Test Dataset

version: 1

Illegal Access To User Content via PowerSploit modules

This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping into http and RDP sessions, etc.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1021, T1113, T1123, T1563
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1021 Remote Services Lateral Movement
T1113 Screen Capture Collection
T1123 Audio Capture Collection
T1563 Remote Service Session Hijacking Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Account Creation via PowerSploit modules

This detection identifies access to PowerSploit modules that create accounts illegaly.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1585
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1585 Establish Accounts Resource Development

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Deletion of Logs via Mimikatz modules

This detection identifies access to PowerSploit modules that delete event logs.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1070
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1070 Indicator Removal on Host Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Enabling or Disabling of Accounts via DSInternals modules

This detection identifies use of DSInternals modules that enable or disable accounts illegaly.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1078, T1098
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Management of Active Directory Elements and Policies via DSInternals modules

This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1098, T1207, T1484
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1098 Account Manipulation Persistence
T1207 Rogue Domain Controller Defense Evasion
T1484 Domain Policy Modification Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Management of Computers and Active Directory Elements via PowerSploit modules

This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1098, T1207, T1484
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )


| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1098 Account Manipulation Persistence
T1207 Rogue Domain Controller Defense Evasion
T1484 Domain Policy Modification Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Privilege Elevation and Persistence via PowerSploit modules

This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent WMI, access to OS objects under desired identities.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1053, T1134, T1548
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
T1134 Access Token Manipulation Defense Evasion, Privilege Escalation
T1548 Abuse Elevation Control Mechanism Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Privilege Elevation via Mimikatz modules

This detection identifies use of Mimikatz modules for illegal privilege elevation.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1134, T1548
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1134 Access Token Manipulation Defense Evasion, Privilege Escalation
T1548 Abuse Elevation Control Mechanism Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Service and Process Control via Mimikatz modules

This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1055, T1106, T1569
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true OR match_regex(cmd_line, /(?i)misc::memssp/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1055 Process Injection Defense Evasion, Privilege Escalation
T1106 Native API Execution
T1569 System Services Execution

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Illegal Service and Process Control via PowerSploit modules

This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, modifying access to service objects, etc.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1055, T1106, T1569
  • Last Updated: 2020-11-09
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true )


| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1055 Process Injection Defense Evasion, Privilege Escalation
T1106 Native API Execution
T1569 System Services Execution

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Kerberoasting spn request with RC4 encryption

This search detects a potential kerberoasting attack via service principal name requests

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1558.003
  • Last Updated: 2020-10-16
details

Search

`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `kerberoasting_spn_request_with_rc4_encryption_filter`

Associated Analytic Story

  • Lateral Movement

How To Implement

You must be ingesting endpoint data that tracks process activity, and include the windows security event logs that contain kerberos

Required field

ATT&CK

ID Technique Tactic
T1558.003 Kerberoasting Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Older systems that support kerberos RC4 by default NetApp may generate false positives

Reference

Test Dataset

version: 3

Malicious PowerShell Process - Connect To Internet With Hidden Window

This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1059.001
  • Last Updated: 2020-11-20
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" by Processes.user Processes.process_name Processes.parent_process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`

Associated Analytic Story

  • Malicious PowerShell

  • Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1059.001 PowerShell Execution

Kill Chain Phase

  • Command and Control

  • Actions on Objectives

Known False Positives

Legitimate process can have this combination of command-line options, but it's not common.

Reference

Test Dataset

version: 5

Malicious PowerShell Process - Encoded Command

This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1027
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `malicious_powershell_process___encoded_command_filter`

Associated Analytic Story

  • Malicious PowerShell

  • Sunburst Malware

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1027 Obfuscated Files or Information Defense Evasion

Kill Chain Phase

  • Command and Control

  • Actions on Objectives

Known False Positives

System administrators may use this option, but it's not common.

Reference

Test Dataset

version: 4

Malicious PowerShell Process - Execution Policy Bypass

This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1059.001
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe (Processes.process="* -ex*" OR Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `malicious_powershell_process___execution_policy_bypass_filter`

Associated Analytic Story

  • DHS Report TA18-074A

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1059.001 PowerShell Execution

Kill Chain Phase

  • Command and Control

  • Actions on Objectives

Known False Positives

There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.

Reference

Test Dataset

version: 4

Malicious PowerShell Process With Obfuscation Techniques

This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1059.001
  • Last Updated: 2021-01-19
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "'"))-1) 
| `malicious_powershell_process_with_obfuscation_techniques_filter` 
| search num_obfuscation > 10

Associated Analytic Story

  • Malicious PowerShell

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1059.001 PowerShell Execution

Kill Chain Phase

  • Command and Control

  • Actions on Objectives

Known False Positives

These characters might be legitimately on the command-line, but it is not common.

Reference

Test Dataset

version: 4

Monitor Registry Keys for Print Monitors

This search looks for registry activity associated with modifications to the registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1547.010
  • Last Updated: 2020-11-23
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action 
| `drop_dm_object_name(Registry)` 
| `monitor_registry_keys_for_print_monitors_filter`

Associated Analytic Story

  • Suspicious Windows Registry Activities

  • Windows Persistence Techniques

How To Implement

To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.

Required field

ATT&CK

ID Technique Tactic
T1547.010 Port Monitors Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

You will encounter noise from legitimate print-monitor registry entries.

Reference

Test Dataset

version: 2

More than usual number of LOLBAS applications in short time period

Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1059, T1053
  • Last Updated: 2020-08-25
details

Search

 
| from read_ssa_enriched_events() 
| eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
| where process_name=="regsvcs.exe" OR process_name=="ftp.exe" OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" OR process_name=="msconfig.exe" 
| stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) 
| eval lolbas_counter=lolbas_counter*1.0 
| rename window_end as timestamp 
| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L 
| where label AND quantile>0.99 
| eval start_time = window_start, end_time = timestamp, entities = mvappend(device), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

Collect endpoint data such as sysmon or 4688 events.

Required field

  • dest_device_id

  • _time

  • process_name

ATT&CK

ID Technique Tactic
T1059 Command and Scripting Interpreter Execution
T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation

Kill Chain Phase

  • Exploitation

Known False Positives

Some administrative tasks may involve multiple use of LOLBAS applications in a short period of time. This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline.

Reference

Test Dataset

version: 1

Multiple Okta Users With Invalid Credentials From The Same IP

This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078.001
  • Last Updated: 2020-07-21
details

Search

`okta` outcome.reason=INVALID_CREDENTIALS 
| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city 
| stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city  
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
|  search distinct_users > 5
| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter`

Associated Analytic Story

  • Suspicious Okta Activity

How To Implement

This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.

Required field

ATT&CK

ID Technique Tactic
T1078.001 Default Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter to raise the threshold or except specific IP adresses from triggering this search.

Reference

Test Dataset

version: 2

NLTest Domain Trust Discovery

This search looks for the execution of nltest.exe with command-line arguments utilized to query for Domain Trust information. Two arguments /domain trusts, returns a list of trusted domains, and /all_trusts, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1482
  • Last Updated: 2021-01-25
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `nltest_domain_trust_discovery_filter`

Associated Analytic Story

  • Ryuk Ransomware

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1482 Domain Trust Discovery Discovery

Kill Chain Phase

  • Exploitation

Known False Positives

Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.

Reference

Test Dataset

version: 1

New container uploaded to AWS ECR

This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1525
  • Last Updated: 2020-02-20
details

Search


| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.http_user_agent="AWS Internal" AND Compute.event_name="PutImage" by Compute.image_id Compute.src_user Compute.src Compute.region Compute.msg Compute.user_type 
| `drop_dm_object_name("Compute")` 
| `new_container_uploaded_to_aws_ecr_filter`

Associated Analytic Story

  • Container Implantation Monitoring and Investigation

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the container_implant_aws_detection_filter macro to filter out the false positives.

Required field

ATT&CK

ID Technique Tactic
T1525 Implant Container Image Persistence

Kill Chain Phase

Known False Positives

Uploading container is a normal behavior from developers or users with access to container registry.

Reference

Test Dataset

version: 1

Ntdsutil export ntds

Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit
ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q
This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1003.003
  • Last Updated: 2021-01-28
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `ntdsutil_export_ntds_filter`

Associated Analytic Story

  • Credential Dumping

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1003.003 NTDS Credential Access

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives.

Reference

Test Dataset

version: 1

O365 Add App Role Assignment Grant User

This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1136.003
  • Last Updated: 2021-01-26
details

Search

`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." 
| stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `o365_add_app_role_assignment_grant_user_filter`

Associated Analytic Story

  • Office 365 Detections

  • Cloud Federated Credential Abuse

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1136.003 Cloud Account Persistence

Kill Chain Phase

  • Actions on Objective

Known False Positives

The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.

Reference

Test Dataset

version: 1

O365 Added Service Principal

This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1136.003
  • Last Updated: 2021-01-26
details

Search

`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." 
| stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `o365_added_service_principal_filter`

Associated Analytic Story

  • Office 365 Detections

  • Cloud Federated Credential Abuse

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1136.003 Cloud Account Persistence

Kill Chain Phase

  • Actions on Objective

Known False Positives

The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.

Reference

Test Dataset

version: 1

O365 Bypass MFA via Trusted IP

This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1562.007
  • Last Updated: 2021-01-12
details

Search

`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy 
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" 
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" 
| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") 
| mvexpand ip_addresses_new_added 
| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) 
|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_bypass_mfa_via_trusted_ip_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1562.007 Disable or Modify Cloud Firewall Defense Evasion

Kill Chain Phase

  • Actions on Objective

Known False Positives

Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.

Reference

Test Dataset

version: 1

O365 Disable MFA

This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1556
  • Last Updated: 2020-12-16
details

Search

`o365_management_activity` Operation="Disable Strong Authentication." 
| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `o365_disable_mfa_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1556 Modify Authentication Process Credential Access, Defense Evasion

Kill Chain Phase

  • Actions on Objective

Known False Positives

Unless it is a special case, it is uncommon to disable MFA or Strong Authentication

Reference

Test Dataset

version: 1

O365 Excessive Authentication Failures Alert

This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1110
  • Last Updated: 2020-12-16
details

Search

`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed 
| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
| where count > 10 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `o365_excessive_authentication_failures_alert_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1110 Brute Force Credential Access

Kill Chain Phase

  • Not Applicable

Known False Positives

The threshold for alert is above 10 attempts and this should reduce the number of false positives.

Reference

Test Dataset

version: 1

O365 Excessive SSO logon errors

This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1556
  • Last Updated: 2021-01-26
details

Search

`o365_management_activity`  Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired 
| stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId 
| where count > 5 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `o365_excessive_sso_logon_errors_filter`

Associated Analytic Story

  • Office 365 Detections

  • Cloud Federated Credential Abuse

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1556 Modify Authentication Process Credential Access, Defense Evasion

Kill Chain Phase

  • Actions on Objective

Known False Positives

Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.

Reference

Test Dataset

version: 1

O365 New Federated Domain Added

This search detects the addition of a new Federated domain.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1136.003
  • Last Updated: 2021-01-26
details

Search

`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" 
| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_new_federated_domain_added_filter`

Associated Analytic Story

  • Office 365 Detections

  • Cloud Federated Credential Abuse

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity.

Required field

ATT&CK

ID Technique Tactic
T1136.003 Cloud Account Persistence

Kill Chain Phase

  • Actions on Objective

Known False Positives

The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.

Reference

Test Dataset

version: 1

O365 PST export alert

This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1114
  • Last Updated: 2020-12-16
details

Search

`o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" 
| stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Operation Name 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `o365_pst_export_alert_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

ATT&CK

ID Technique Tactic
T1114 Email Collection Collection

Kill Chain Phase

  • Actions on Objective

Known False Positives

PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.

Reference

Test Dataset

version: 1

O365 Suspicious Admin Email Forwarding

This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1114.003
  • Last Updated: 2020-12-16
details

Search

`o365_management_activity` Operation=Set-Mailbox 
| spath input=Parameters 
| rename Identity AS src_user 
| search ForwardingAddress=* 
| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress 
| where count_src_user > 1 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
|`o365_suspicious_admin_email_forwarding_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

Required field

ATT&CK

ID Technique Tactic
T1114.003 Email Forwarding Rule Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

unknown

Reference

Test Dataset

version: 1

O365 Suspicious Rights Delegation

This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1114.002
  • Last Updated: 2020-12-15
details

Search

`o365_management_activity` Operation=Add-MailboxPermission 
| spath input=Parameters 
| rename User AS src_user, Identity AS dest_user 
| search AccessRights=FullAccess OR AccessRights=SendAs OR AccessRights=SendOnBehalf 
| stats count earliest(_time) as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
|`o365_suspicious_rights_delegation_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

Required field

ATT&CK

ID Technique Tactic
T1114.002 Remote Email Collection Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Service Accounts

Reference

Test Dataset

version: 1

O365 Suspicious User Email Forwarding

This search detects when multiple user configured a forwarding rule to the same destination.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1114.003
  • Last Updated: 2020-12-16
details

Search

`o365_management_activity` Operation=Set-Mailbox 
| spath input=Parameters 
| rename Identity AS src_user 
| search ForwardingSmtpAddress=* 
| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress 
| where count_src_user > 1 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
|`o365_suspicious_user_email_forwarding_filter`

Associated Analytic Story

  • Office 365 Detections

How To Implement

Required field

ATT&CK

ID Technique Tactic
T1114.003 Email Forwarding Rule Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

unknown

Reference

Test Dataset

version: 1

Okta Account Lockout Events

Detect Okta user lockout events

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078.001
  • Last Updated: 2020-07-21
details

Search

`okta` displayMessage="Max sign in attempts exceeded" 
| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city 
| table _time, user, country, state, city, src_ip 
| `okta_account_lockout_events_filter`

Associated Analytic Story

  • Suspicious Okta Activity

How To Implement

This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.

Required field

ATT&CK

ID Technique Tactic
T1078.001 Default Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.

Reference

Test Dataset

version: 2

Okta Failed SSO Attempts

Detect failed Okta SSO events

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078.001
  • Last Updated: 2020-07-21
details

Search

`okta` displayMessage="User attempted unauthorized access to app" 
| stats  min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `okta_failed_sso_attempts_filter`

Associated Analytic Story

  • Suspicious Okta Activity

How To Implement

This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.

Required field

ATT&CK

ID Technique Tactic
T1078.001 Default Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

There may be a faulty config preventing legitmate users from accessing apps they should have access to.

Reference

Test Dataset

version: 2

Okta User Logins From Multiple Cities

This search detects logins from the same user from different cities in a 24 hour period.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078.001
  • Last Updated: 2020-07-21
details

Search

`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null 
| stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `okta_user_logins_from_multiple_cities_filter` 
| search locations > 1

Associated Analytic Story

  • Suspicious Okta Activity

How To Implement

This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.

Required field

ATT&CK

ID Technique Tactic
T1078.001 Default Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

Known False Positives

Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should not be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint.

Reference

Test Dataset

version: 2

Overwriting Accessibility Binaries

Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1546.008
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.file_name Filesystem.dest 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `overwriting_accessibility_binaries_filter`

Associated Analytic Story

  • Windows Privilege Escalation

How To Implement

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic
T1546.008 Accessibility Features Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle.

Reference

Test Dataset

version: 4

Probing Access with Stolen Credentials via PowerSploit modules

This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1078, T1098
  • Last Updated: 2020-11-04
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_user_id

  • dest_device_id

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Process Creating LNK file in Suspicious Location

This search looks for a process launching an *.lnk file under C:\User* or *\Local\Temp\*. This is common behavior used by various spear phishing tools.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1566.002
  • Last Updated: 2021-01-28
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND Filesystem.file_path="C:\\Temp*"  by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user 
| `drop_dm_object_name(Filesystem)` 
| rename process_id as lnk_pid 
| join lnk_pid, _time [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*  by _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process 
| `drop_dm_object_name(Processes)` 
| rename parent_process_id as lnk_pid 
| fields _time lnk_pid process_id dest process_name process_path process] 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash 
| `process_creating_lnk_file_in_suspicious_location_filter`

Associated Analytic Story

  • Phishing Payloads

How To Implement

You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.

Required field

ATT&CK

ID Technique Tactic
T1566.002 Spearphishing Link Initial Access

Kill Chain Phase

  • Installation

  • Actions on Objectives

Known False Positives

This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories.

Reference

Test Dataset

version: 4

Process Execution via WMI

This search looks for processes launched via WMI.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1047
  • Last Updated: 2020-03-16
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name  
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `process_execution_via_wmi_filter`

Associated Analytic Story

  • Suspicious WMI Use

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1047 Windows Management Instrumentation Execution

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, administrators may use wmi to execute commands for legitimate purposes.

Reference

Test Dataset

version: 3

Processes launching netsh

This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1562.004
  • Last Updated: 2020-07-10
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.user Processes.dest 
|`drop_dm_object_name("Processes")` 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
|`processes_launching_netsh_filter`

Associated Analytic Story

  • Netsh Abuse

  • Disabling Security Tools

  • DHS Report TA18-074A

How To Implement

To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model

Required field

ATT&CK

ID Technique Tactic
T1562.004 Disable or Modify System Firewall Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.

Reference

Test Dataset

version: 3

Rare Parent-Child Process Relationship

An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1203, T1059, T1053, T1072
  • Last Updated: 2020-08-13
details

Search


| from read_ssa_enriched_events() 
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
| eval parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) 
| where parent_process_name!=null 
| select parent_process_name, process_name, timestamp, dest_device_id, dest_user_id 
| conditional_anomaly conditional="parent_process_name" target="process_name" 
| rename output as input 
| where input < 1 
| adaptive_threshold algorithm="quantile" entity="parent_process_name" window=604800000L 
| where label AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")

| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

Collect endpoint data such as sysmon or 4688 events.

Required field

  • process_name

  • parent_process_name

  • _time

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1203 Exploitation for Client Execution Execution
T1059 Command and Scripting Interpreter Execution
T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
T1072 Software Deployment Tools Execution, Lateral Movement

Kill Chain Phase

  • Exploitation

Known False Positives

Some custom tools used by admins could be used rarely to launch remotely applications. This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules

This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1078, T1087, T1484
  • Last Updated: 2020-11-05
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, /(?i)Get-LastLoggedOn/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1087 Account Discovery Discovery
T1484 Domain Policy Modification Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Accounts and Groups via Mimikatz modules

This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1078, T1087, T1484
  • Last Updated: 2020-11-05
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1087 Account Discovery Discovery
T1484 Domain Policy Modification Defense Evasion, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules

This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, AD sites and forests, and trust relations.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1199 Trusted Relationship Initial Access
T1482 Domain Trust Discovery Discovery
T1590 Gather Victim Network Information Reconnaissance
T1591 Gather Victim Org Information Reconnaissance
T1595 Active Scanning Reconnaissance

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Computers and Domains via PowerSploit modules

This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1592, T1590, T1087
  • Last Updated: 2020-11-06
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1592 Gather Victim Host Information Reconnaissance
T1590 Gather Victim Network Information Reconnaissance
T1087 Account Discovery Discovery

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Computers via Mimikatz modules

This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1592
  • Last Updated: 2020-11-06
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1592 Gather Victim Host Information Reconnaissance

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Operating System Elements via PowerSploit modules

This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, security packages and files.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, /(?i)Get-RegistryMountedDrive/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1007 System Service Discovery Discovery
T1012 Query Registry Discovery
T1046 Network Service Scanning Discovery
T1047 Windows Management Instrumentation Execution
T1057 Process Discovery Discovery
T1083 File and Directory Discovery Discovery
T1518 Software Discovery Discovery
T1592.002 Software Reconnaissance

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Processes and Services via Mimikatz modules

This detection identifies use of Mimikatz modules for discovery and access to services and processes.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1007, T1046, T1057
  • Last Updated: 2020-11-06
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1007 System Service Discovery Discovery
T1046 Network Service Scanning Discovery
T1057 Process Discovery Discovery

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Shared Resources via Mimikatz modules

This detection identifies use of Mimikatz modules for discovery and access to network shares.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1021.002, T1135, T1039
  • Last Updated: 2020-11-06
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement
T1135 Network Share Discovery Discovery
T1039 Data from Network Shared Drive Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance and Access to Shared Resources via PowerSploit modules

This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1021.002, T1135, T1039
  • Last Updated: 2020-11-06
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement
T1135 Network Share Discovery Discovery
T1039 Data from Network Shared Drive Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance of Access and Persistence Opportunities via PowerSploit modules

This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, weak access control policies, landing paths for dropping malicious software or data to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities, as well as services and system files that can be compromised.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1543 Create or Modify System Process Persistence, Privilege Escalation
T1547 Boot or Logon Autostart Execution Persistence, Privilege Escalation
T1574 Hijack Execution Flow Defense Evasion, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance of Connectivity via PowerSploit modules

This detection identifies access to PowerSploit modules for reconnaissance of connectivity.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1021.002, T1135, T1039
  • Last Updated: 2020-11-06
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement
T1135 Network Share Discovery Discovery
T1039 Data from Network Shared Drive Collection

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance of Credential Stores and Services via Mimikatz modules

This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules.

details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1589.001 Credentials Reconnaissance
T1590.001 Domain Properties Reconnaissance
T1590.003 Network Trust Dependencies Reconnaissance
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance of Defensive Tools via PowerSploit modules

This detection identifies use of PowerSploit modules for assessment of presence of defensive tools.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1595.002, T1592.002
  • Last Updated: 2020-11-05
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1595.002 Vulnerability Scanning Reconnaissance
T1592.002 Software Reconnaissance

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules

This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1068, T1078, T1098
  • Last Updated: 2020-11-05
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules

This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft Detours is an open source library for intercepting, monitoring and instrumenting binary functions on Microsoft Windows. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments called payloads to any Win32 binary.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1543, T1055, T1574
  • Last Updated: 2020-11-05
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • _time

  • process

  • dest_device_id

  • dest_user_id

ATT&CK

ID Technique Tactic
T1543 Create or Modify System Process Persistence, Privilege Escalation
T1055 Process Injection Defense Evasion, Privilege Escalation
T1574 Hijack Execution Flow Defense Evasion, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Reg exe Manipulating Windows Services Registry Keys

The search looks for reg.exe modifying registry keys that define Windows services and their configurations.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1574.011
  • Last Updated: 2020-11-26
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services* by Processes.process_id Processes.dest Processes.process 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `reg_exe_manipulating_windows_services_registry_keys_filter`

Associated Analytic Story

  • Windows Service Abuse

  • Windows Persistence Techniques

How To Implement

To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.

Required field

ATT&CK

ID Technique Tactic
T1574.011 Services Registry Permissions Weakness Defense Evasion, Persistence, Privilege Escalation

Kill Chain Phase

  • Installation

Known False Positives

It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.

Reference

Test Dataset

version: 5

Registry Keys Used For Persistence

The search looks for modifications to registry keys that can be used to launch an application or service at system startup.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1547.001
  • Last Updated: 2020-11-27
details

Search


| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) by Registry.dest Registry.user 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name(Registry)` 
| `registry_keys_used_for_persistence_filter`

Associated Analytic Story

  • Suspicious Windows Registry Activities

  • Suspicious MSHTA Activity

  • DHS Report TA18-074A

  • Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns

  • Ransomware

  • Windows Persistence Techniques

  • Emotet Malware DHS Report TA18-201A

How To Implement

To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.

Required field

ATT&CK

ID Technique Tactic
T1547.001 Registry Run Keys / Startup Folder Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.

Reference

Test Dataset

version: 5

Registry Keys Used For Privilege Escalation

This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1546.012
  • Last Updated: 2020-11-27
details

Search


| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_key_name=GlobalFlag OR Registry.registry_key_name=Debugger) by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name 
| `security_content_ctime(lastTime)`  
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name(Registry)` 
| `registry_keys_used_for_privilege_escalation_filter`

Associated Analytic Story

  • Windows Privilege Escalation

  • Suspicious Windows Registry Activities

  • Cloud Federated Credential Abuse

How To Implement

To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.

Required field

ATT&CK

ID Technique Tactic
T1546.012 Image File Execution Options Injection Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.

Reference

Test Dataset

version: 4

Registry Keys for Creating SHIM Databases

This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1546.011
  • Last Updated: 2020-11-26
details

Search


| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name(Registry)` 
| `registry_keys_for_creating_shim_databases_filter`

Associated Analytic Story

  • Suspicious Windows Registry Activities

  • Windows Persistence Techniques

How To Implement

To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.

Required field

ATT&CK

ID Technique Tactic
T1546.011 Application Shimming Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications

Reference

Test Dataset

version: 3

Remote Desktop Network Bruteforce

This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1021.001
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=rdp by All_Traffic.src All_Traffic.dest All_Traffic.dest_port 
| eventstats stdev(count) AS stdev avg(count) AS avg p50(count) AS p50 
| where count>(avg + stdev*2) 
| rename All_Traffic.src AS src All_Traffic.dest AS dest 
| table firstTime lastTime src dest count avg p50 stdev 
| `remote_desktop_network_bruteforce_filter`

Associated Analytic Story

  • SamSam Ransomware

  • Ryuk Ransomware

How To Implement

You must ensure that your network traffic data is populating the Network_Traffic data model.

Required field

ATT&CK

ID Technique Tactic
T1021.001 Remote Desktop Protocol Lateral Movement

Kill Chain Phase

  • Reconnaissance

  • Delivery

Known False Positives

RDP gateways may have unusually high amounts of traffic from all other hosts' RDP applications in the network.

Reference

Test Dataset

version: 2

Remote Desktop Network Traffic

This search looks for network traffic on TCP/3389, the default port used by remote desktop. While remote desktop traffic is not uncommon on a network, it is usually associated with known hosts. This search will ignore common RDP sources and common RDP destinations so you can focus on the uncommon uses of remote desktop on your network.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1021.001
  • Last Updated: 2020-07-07
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source by All_Traffic.src All_Traffic.dest All_Traffic.dest_port 
| `drop_dm_object_name("All_Traffic")` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `remote_desktop_network_traffic_filter`

Associated Analytic Story

  • SamSam Ransomware

  • Ryuk Ransomware

  • Hidden Cobra Malware

  • Lateral Movement

How To Implement

To successfully implement this search you need to identify systems that commonly originate remote desktop traffic and that commonly receive remote desktop traffic. You can use the included support search "Identify Systems Creating Remote Desktop Traffic" to identify systems that originate the traffic and the search "Identify Systems Receiving Remote Desktop Traffic" to identify systems that receive a lot of remote desktop traffic. After identifying these systems, you will need to add the "common_rdp_source" or "common_rdp_destination" category to that system depending on the usage, using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in SA-IdentityManagement/lookups.

Required field

ATT&CK

ID Technique Tactic
T1021.001 Remote Desktop Protocol Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Remote Desktop may be used legitimately by users on the network.

Reference

Test Dataset

version: 3

Remote Process Instantiation via WMI

This search looks for wmic.exe being launched with parameters to spawn a process on a remote system.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1047
  • Last Updated: 2020-11-30
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wmic.exe Processes.process="*/node*" Processes.process="*process*" Processes.process="*call*" Processes.process="*create*"   by Processes.process_name Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `remote_process_instantiation_via_wmi_filter`

Associated Analytic Story

  • Ransomware

  • Suspicious WMI Use

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1047 Windows Management Instrumentation Execution

Kill Chain Phase

  • Actions on Objectives

Known False Positives

The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon.

Reference

Test Dataset

version: 5

RunDLL Loading DLL By Ordinal

This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.011
  • Last Updated: 2020-11-30
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = rundll32.exe by Processes.process_name Processes.parent_process_name Processes.process Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `rundll_loading_dll_by_ordinal_filter`

Associated Analytic Story

  • Unusual Processes

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Installation

Known False Positives

While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process

Reference

Test Dataset

version: 4

Ryuk Test Files Detected

The search looks for files that contain the key word Ryuk under any folder in the C drive, which is consistent with Ryuk propagation.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1486
  • Last Updated: 2020-11-06
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `ryuk_test_files_detected_filter`

Associated Analytic Story

  • Ryuk Ransomware

How To Implement

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic
T1486 Data Encrypted for Impact Impact

Kill Chain Phase

  • Delivery

Known False Positives

If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs.

Reference

Test Dataset

version: 1

SMB Traffic Spike

This search looks for spikes in the number of Server Message Block (SMB) traffic connections.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1021.002
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src 
| `drop_dm_object_name("All_Traffic")` 
| eventstats max(_time) as maxtime 
| stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-70m@m"), count, null))) as count avg(eval(if(_time<relative_time(maxtime, "-70m@m"), count, null))) as avg stdev(eval(if(_time<relative_time(maxtime, "-70m@m"), count, null))) as stdev by src 
| eval upperBound=(avg+stdev*2), isOutlier=if(count > upperBound AND num_data_samples >=50, 1, 0) 
| where isOutlier=1 
| table src count 
| `smb_traffic_spike_filter`

Associated Analytic Story

  • Emotet Malware DHS Report TA18-201A

  • Hidden Cobra Malware

  • Ransomware

  • DHS Report TA18-074A

How To Implement

This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model.

Required field

ATT&CK

ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

A file server may experience high-demand loads that could cause this analytic to trigger.

Reference

Test Dataset

version: 3

SMB Traffic Spike - MLTK

This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the number of Server Message Block (SMB) connections.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1021.002
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` count values(All_Traffic.dest_ip) as dest values(All_Traffic.dest_port) as port from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src 
| eval HourOfDay=strftime(_time, "%H") 
| eval DayOfWeek=strftime(_time, "%A") 
| `drop_dm_object_name(All_Traffic)` 
| apply smb_pdfmodel threshold=0.001 
| rename "IsOutlier(count)" as isOutlier 
| search isOutlier > 0 
| sort -count 
| table _time src dest port count 
| `smb_traffic_spike___mltk_filter`

Associated Analytic Story

  • Emotet Malware DHS Report TA18-201A

  • Hidden Cobra Malware

  • Ransomware

  • DHS Report TA18-074A

How To Implement

To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of SMB Traffic - MLTK" must be executed before this detection search, because it builds a machine-learning (ML) model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.
This search produces a field (Number of events,count) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. This field contributes additional context to the notable. To see the additional metadata, add the following field, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry): \

  1. Label: Number of events, Field: count
    Detailed documentation on how to create a new field within Incident Review is found here: https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

Required field

ATT&CK

ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement

Kill Chain Phase

  • Actions on Objectives

Known False Positives

If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update the smb_traffic_spike_mltk_filter macro to filter out false positive results

Reference

Test Dataset

version: 3

Samsam Test File Write

The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1486
  • Last Updated: 2018-12-14
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt by Filesystem.file_path 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `samsam_test_file_write_filter`

Associated Analytic Story

  • SamSam Ransomware

How To Implement

You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic
T1486 Data Encrypted for Impact Impact

Kill Chain Phase

  • Delivery

Known False Positives

No false positives have been identified.

Reference

Test Dataset

version: 1

Sc exe Manipulating Windows Services

This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1543.003
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* config *") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `sc_exe_manipulating_windows_services_filter`

Associated Analytic Story

  • Windows Service Abuse

  • DHS Report TA18-074A

  • Orangeworm Attack Group

  • Windows Persistence Techniques

  • Disabling Security Tools

  • Sunburst Malware

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1543.003 Windows Service Persistence, Privilege Escalation

Kill Chain Phase

  • Installation

Known False Positives

Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate.

Reference

Test Dataset

version: 4

Scheduled Task Deleted Or Created via CMD

This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1053.005
  • Last Updated: 2020-12-17
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `scheduled_task_deleted_or_created_via_cmd_filter`

Associated Analytic Story

  • DHS Report TA18-074A

  • Sunburst Malware

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Tasks should not be manually created via CLI, this is rarely done by admins as well

Reference

Test Dataset

version: 5

Schtasks scheduling job on remote system

This search looks for flags passed to schtasks.exe on the command-line that indicate a job is being scheduled on a remote system.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1053.005
  • Last Updated: 2020-07-21
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="* /S *") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `schtasks_scheduling_job_on_remote_system_filter`

Associated Analytic Story

  • Lateral Movement

  • Sunburst Malware

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators may create jobs on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate.

Reference

Test Dataset

version: 4

Schtasks used for forcing a reboot

This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1053.005
  • Last Updated: 2020-12-07
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `schtasks_used_for_forcing_a_reboot_filter`

Associated Analytic Story

  • Windows Persistence Techniques

  • Ransomware

How To Implement

To successfully implement this search you need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc.

Reference

Test Dataset

version: 4

Script Execution via WMI

This search looks for scripts launched via WMI.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1047
  • Last Updated: 2020-03-16
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name  
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `script_execution_via_wmi_filter`

Associated Analytic Story

  • Suspicious WMI Use

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1047 Windows Management Instrumentation Execution

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.

Reference

Test Dataset

version: 3

Setting Credentials via DSInternals modules

This detection identifies illegal setting of credentials via DSInternals modules.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1068, T1078, T1098
  • Last Updated: 2020-11-03
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • process_name

  • parent_process_name

  • _time

  • process_path

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Setting Credentials via Mimikatz modules

This detection identifies illegal setting of credentials via Mimikatz modules.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1068, T1078, T1098
  • Last Updated: 2020-11-03
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Setting Credentials via PowerSploit modules

This detection identifies illegal setting of credentials via PowerSploit modules.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1068, T1078, T1098
  • Last Updated: 2020-11-03
details

Search


| from read_ssa_enriched_events()

| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) 
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true )

| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.

Required field

  • dest_device_id

  • dest_user_id

  • process

  • _time

ATT&CK

ID Technique Tactic
T1068 Exploitation for Privilege Escalation Privilege Escalation
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1098 Account Manipulation Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified.

Reference

Test Dataset

version: 1

Shim Database File Creation

This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1546.011
  • Last Updated: 2020-12-08
details

Search


| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.file_name Filesystem.dest 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
|`drop_dm_object_name(Filesystem)` 
| `shim_database_file_creation_filter`

Associated Analytic Story

  • Windows Persistence Techniques

How To Implement

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic
T1546.011 Application Shimming Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation.

Reference

Test Dataset

version: 3

Shim Database Installation With Suspicious Parameters

This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1546.011
  • Last Updated: 2020-11-23
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe by Processes.process_name Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `shim_database_installation_with_suspicious_parameters_filter`

Associated Analytic Story

  • Windows Persistence Techniques

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1546.011 Application Shimming Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified

Reference

Test Dataset

version: 4

Short Lived Windows Accounts

This search detects accounts that were created and deleted in a short time period.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Change
  • ATT&CK: T1136.001
  • Last Updated: 2020-07-06
details

Search


| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name("All_Changes")` 
| search result_id = 4720 result_id=4726 
| transaction user connected=false maxspan=240m 
| table firstTime lastTime count user dest result_id 
| `short_lived_windows_accounts_filter`

Associated Analytic Story

  • Account Monitoring and Controls

How To Implement

This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/

Required field

ATT&CK

ID Technique Tactic
T1136.001 Local Account Persistence

Kill Chain Phase

Known False Positives

It is possible that an administrator created and deleted an account in a short time period. Verifying activity with an administrator is advised.

Reference

Test Dataset

version: 2

Single Letter Process On Endpoint

This search looks for process names that consist only of a single letter.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1204.002
  • Last Updated: 2020-12-08
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user, Processes.process, Processes.process_name 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| eval process_name_length = len(process_name), endExe = if(substr(process_name, -4) == ".exe", 1, 0) 
| search process_name_length=5 AND endExe=1 
| table count, firstTime, lastTime, dest, user, process, process_name 
| `single_letter_process_on_endpoint_filter`

Associated Analytic Story

  • DHS Report TA18-074A

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1204.002 Malicious File Execution

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process.

Reference

Test Dataset

version: 3

Suspicious MSBuild Rename

The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1127.001, T1036.003
  • Last Updated: 2021-01-12
details

Search

`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe) 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `suspicious_msbuild_rename_filter`

Associated Analytic Story

  • Trusted Developer Utilities Proxy Execution MSBuild

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1127.001 MSBuild Defense Evasion
T1036.003 Rename System Utilities Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious MSBuild Spawn

The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1127.001
  • Last Updated: 2021-01-12
details

Search


| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe AND Processes.process_name=msbuild.exe by Processes.dest Processes.parent_process Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_msbuild_spawn_filter`

Associated Analytic Story

  • Trusted Developer Utilities Proxy Execution MSBuild

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1127.001 MSBuild Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious Reg exe Process

This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1112
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| search [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id Processes.dest Processes.process_name 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| rename parent_process_id as process_id 
|dedup process_id
| table process_id dest] 
| `suspicious_reg_exe_process_filter`

Associated Analytic Story

  • Windows Defense Evasion Tactics

  • Disabling Security Tools

  • DHS Report TA18-074A

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1112 Modify Registry Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out.

Reference

Test Dataset

version: 4

Suspicious Regsvr32 Register Suspicious Path

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.010
  • Last Updated: 2021-01-28
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `suspicious_regsvr32_register_suspicious_path_filter`

Associated Analytic Story

  • Suspicious Regsvr32 Activity

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by legitimate processes.

Required field

ATT&CK

ID Technique Tactic
T1218.010 Regsvr32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.

Reference

Test Dataset

version: 1

Suspicious Rundll32 Rename

The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the OriginalFileName from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.011, T1036.003
  • Last Updated: 2021-02-04
details

Search

`sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `suspicious_rundll32_rename_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion
T1036.003 Rename System Utilities Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious Rundll32 StartW

The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.011
  • Last Updated: 2021-02-04
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_rundll32_startw_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

  • Cobalt Strike

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.

Reference

Test Dataset

version: 1

Suspicious Rundll32 dllregisterserver

The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.011
  • Last Updated: 2021-02-09
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_rundll32_dllregisterserver_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.

Reference

Test Dataset

version: 1

Suspicious Rundll32 no CommandLine Arguments

The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1218.011
  • Last Updated: 2021-02-09
details

Search

`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE) 
| regex CommandLine="(rundll32\.exe.{0,4}$)" 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_rundll32_no_commandline_arguments_filter`

Associated Analytic Story

  • Suspicious Rundll32 Activity

  • Cobalt Strike

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.011 Rundll32 Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious microsoft workflow compiler rename

The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect.

details

Search

`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe) 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
| rename Computer as dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `suspicious_microsoft_workflow_compiler_rename_filter`

Associated Analytic Story

  • Trusted Developer Utilities Proxy Execution

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious microsoft workflow compiler usage

The following analytic identifies microsoft.workflow.compiler.exe usage. microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. It is not a commonly used process by many applications.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1127
  • Last Updated: 2021-01-12
details

Search


| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe by Processes.dest Processes.parent_process Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_microsoft_workflow_compiler_usage_filter`

Associated Analytic Story

  • Trusted Developer Utilities Proxy Execution

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1127 Trusted Developer Utilities Proxy Execution Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM.

Reference

Test Dataset

version: 1

Suspicious msbuild path

The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1127.001, T1036.003
  • Last Updated: 2021-01-12
details

Search


| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*) by Processes.dest Processes.parent_process Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `suspicious_msbuild_path_filter`

Associated Analytic Story

  • Trusted Developer Utilities Proxy Execution MSBuild

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1127.001 MSBuild Defense Evasion
T1036.003 Rename System Utilities Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.

Reference

Test Dataset

version: 1

Suspicious mshta child process

The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.005
  • Last Updated: 2021-01-12
details

Search


| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe OR Processes.process_name=msbuild.exe OR Processes.process_name=microsoft.workflow.compiler.exe OR Processes.process_name=searchprotocolhost.exe OR Processes.process_name=scrcons.exe OR Processes.process_name=cscript.exe OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_mshta_child_process_filter`

Associated Analytic Story

  • Suspicious MSHTA Activity

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1218.005 Mshta Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious mshta spawn

The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1218.005
  • Last Updated: 2021-01-20
details

Search


| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wmiprvse.exe) AND Processes.process_name=mshta.exe by Processes.dest Processes.parent_process Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_mshta_spawn_filter`

Associated Analytic Story

  • Suspicious MSHTA Activity

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1218.005 Mshta Defense Evasion

Kill Chain Phase

  • Exploitation

Known False Positives

Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.

Reference

Test Dataset

version: 1

Suspicious wevtutil Usage

The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1070.001
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `suspicious_wevtutil_usage_filter`

Associated Analytic Story

  • Windows Log Manipulation

  • Ransomware

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1070.001 Clear Windows Event Logs Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.

Reference

Test Dataset

version: 3

Suspicious writes to windows Recycle Bin

This search detects writes to the recycle bin by a process other than explorer.exe.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1036
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" by Filesystem.process_id Filesystem.dest 
| `drop_dm_object_name("Filesystem")`
| search [
| tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name != "explorer.exe" by Processes.process_id Processes.dest
| `drop_dm_object_name("Processes")` 
| table process_id dest] 
| `suspicious_writes_to_windows_recycle_bin_filter`

Associated Analytic Story

  • Collection and Staging

How To Implement

To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the Endpoint datamodel in the Processes and Filesystem nodes.

Required field

ATT&CK

ID Technique Tactic
T1036 Masquerading Defense Evasion

Kill Chain Phase

Known False Positives

Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate.

Reference

Test Dataset

version: 4

System Information Discovery Detection

Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1082
  • Last Updated: 2020-10-12
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user Processes.process_name Processes.process Processes.dest 
| `drop_dm_object_name(Processes)` 
| eventstats dc(process) as dc_processes_by_dest by dest 
| where dc_processes_by_dest > 2 
| stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime by user, dest 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `system_information_discovery_detection_filter`

Associated Analytic Story

  • Discovery Techniques

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

ATT&CK

ID Technique Tactic
T1082 System Information Discovery Discovery

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators debugging servers

Reference

Test Dataset

version: 1

System Process Running from Unexpected Location

An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the process from a different folder. This detection checks that a list of system processes run inside C:\Windows\System32 or C:\Windows\SysWOW64 The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK: T1036
  • Last Updated: 2020-08-25
details

Search

 $ssa_input = 
| from read_ssa_enriched_events() 
| eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", null));
$cond_1 = 
| from $ssa_input 
| where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe";
$cond_2 = 
| from $ssa_input 
| where process_name="openwith.exe" OR process_name="optionalfeatures.exe" OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" OR process_name="windowsanytimeupgraderesults.exe";
$cond_3 = 
| from $ssa_input 
| where process_name="windowsanytimeupgradeui.exe" OR process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" OR process_name="easinvoker.exe" OR process_name="efsui.exe";
$cond_4 = 
| from $ssa_input 
| where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe";
$cond_5 = 
| from $ssa_input 
| where process_name="openfiles.exe" OR process_name="osk.exe" OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe";
$cond_6 = 
| from $ssa_input 
| where process_name="tracerpt.exe" OR process_name="tscon.exe" OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";

| from $cond_1 
| union $cond_2 
| union $cond_3 
| union $cond_4 
| union $cond_5 
| union $cond_6 
| where process_path!="c:\\windows\\system32" AND process_path!="c:\\windows\\syswow64" 
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(device, user), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

Collect endpoint data such as sysmon or 4688 events.

Required field

  • dest_device_id

  • process_name

  • _time

  • dest_user_id

  • process_path

ATT&CK

ID Technique Tactic
T1036 Masquerading Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None

Reference

Test Dataset

version: 1

System Processes Run From Unexpected Locations

This search looks for system processes that normally run out of C:\Windows\System32\ or C:\Windows\SysWOW64 that are not run from that location. This can indicate a malicious process that is trying to hide as a legitimate process.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1036.003
  • Last Updated: 2020-12-08
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `is_windows_system_file` 
| `system_processes_run_from_unexpected_locations_filter`

Associated Analytic Story

  • Suspicious Command-Line Executions

  • Unusual Processes

  • Ransomware

How To Implement

To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.

Required field

ATT&CK

ID Technique Tactic
T1036.003 Rename System Utilities Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified

Reference

Test Dataset

version: 5

TOR Traffic

This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Network_Traffic
  • ATT&CK: T1071.001
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `drop_dm_object_name("All_Traffic")` 
| `tor_traffic_filter`

Associated Analytic Story

  • Prohibited Traffic Allowed or Protocol Mismatch

  • Ransomware

  • Command and Control

  • Sunburst Malware

How To Implement

In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated.

Required field

ATT&CK

ID Technique Tactic
T1071.001 Web Protocols Command and Control

Kill Chain Phase

  • Command and Control

Known False Positives

None at this time

Reference

Test Dataset

version: 2

USN Journal Deletion

The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1070
  • Last Updated: 2018-12-03
details

Search


| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| search process="*deletejournal*" AND process="*usn*" 
| `usn_journal_deletion_filter`

Associated Analytic Story

  • Windows Log Manipulation

  • Ransomware

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic
T1070 Indicator Removal on Host Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

None identified

Reference

Test Dataset

version: 2

Unload Sysmon Filter Driver

Attackers often disable security tools to avoid detection. This search looks for the usage of process fltMC.exe to unload a Sysmon Driver that will stop sysmon from collecting the data.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1562.001
  • Last Updated: 2020-07-22
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fltMC.exe AND Processes.process=*unload* AND Processes.process=*SysmonDrv*  by Processes.process_name Processes.process_id Processes.parent_process_name Processes.process Processes.dest Processes.user 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` 
|`unload_sysmon_filter_driver_filter`
| table firstTime lastTime dest user count process_name process_id parent_process_name process

Associated Analytic Story

  • Disabling Security Tools

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with unload_sysmon_filter_driver_filter macro, update this macro to filter out false positives.

Required field

ATT&CK

ID Technique Tactic
T1562.001 Disable or Modify Tools Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Reference

Test Dataset

version: 3

Unusually Long Command Line

Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin to help identify command lines with lengths that are unusual for a given user. This detection is inspired on Unusually Long Command Line authored by Rico Valdez.

  • Product: UEBA for Security Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2020-10-06
details

Search

 
| from read_ssa_enriched_events() 
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
| eval cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null) 
| where cmd_line!=null and dest_user_id!=null 
| eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)
|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, ""))) 
| select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, input 
| adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 
| where label AND quantile>0.99 
| first_time_event input_columns=["dest_device_id", "cmd_line"] 
| where first_time_dest_device_id_cmd_line 
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" 
| into write_ssa_detected_events();

Associated Analytic Story

How To Implement

You must be ingesting sysmon endpoint data that monitors command lines.

Required field

  • process_name

  • _time

  • dest_device_id

  • dest_user_id

  • process

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Actions on Objectives

Known False Positives

This detection may flag suspiciously long command lines when there is not sufficient evidence (samples) for a given process that this detection is tracking; or when there is high variability in the length of the command line for the tracked process. Also, some legitimate applications may use long command lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. Attackers may use this technique to obfuscate their payloads.

Reference

Test Dataset

version: 1

Unusually Long Command Line

Command lines that are extremely long may be indicative of malicious activity on your hosts.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2020-12-08
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|  eval processlen=len(process) 
| eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest 
| stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process 
| `unusually_long_command_line_filter` 
|eval threshold = 3 
| where maxlen > ((threshold*stdevperhost) + avgperhost)

Associated Analytic Story

  • Suspicious Command-Line Executions

  • Unusual Processes

  • Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns

  • Ransomware

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the process field in the Endpoint data model.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Some legitimate applications start with long command lines.

Reference

Test Dataset

version: 5

Unusually Long Command Line - MLTK

Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2019-05-08
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| eval processlen=len(process) 
| search user!=unknown 
| apply cmdline_pdfmodel threshold=0.01 
| rename "IsOutlier(processlen)" as isOutlier 
| search isOutlier > 0 
| table firstTime lastTime user dest process_name process processlen count 
| `unusually_long_command_line___mltk_filter`

Associated Analytic Story

  • Suspicious Command-Line Executions

  • Unusual Processes

  • Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns

  • Ransomware

How To Implement

You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of Command Line Length - MLTK" must be executed before this detection search, as it builds an ML model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.

Reference

Test Dataset

version: 1

Unusually Long Content-Type Length

This search looks for unusually long strings in the Content-Type http header that the client sends the server.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2017-10-13
details

Search

`stream_http` 
| eval cs_content_type_length = len(cs_content_type) 
| where cs_content_type_length > 100 
| table endtime src_ip dest_ip cs_content_type_length cs_content_type url 
| `unusually_long_content_type_length_filter`

Associated Analytic Story

  • Apache Struts Vulnerability

How To Implement

This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

  • Delivery

Known False Positives

Very few legitimate Content-Type fields will have a length greater than 100 characters.

Reference

Test Dataset

version: 1

WBAdmin Delete System Backups

This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1490
  • Last Updated: 2021-01-22
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `wbadmin_delete_system_backups_filter`

Associated Analytic Story

  • Ryuk Ransomware

  • Ransomware

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.

Required field

ATT&CK

ID Technique Tactic
T1490 Inhibit System Recovery Impact

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Administrators may modify the boot configuration.

Reference

Test Dataset

version: 1

WMI Permanent Event Subscription - Sysmon

This search looks for the creation of WMI permanent event subscriptions.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1546.003
  • Last Updated: 2020-12-08
details

Search

`sysmon` EventCode=21 
| rename host as dest 
| table _time, dest, user, Operation, EventType, Query, Consumer, Filter 
| `wmi_permanent_event_subscription___sysmon_filter`

Associated Analytic Story

  • Suspicious WMI Use

How To Implement

To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.

Required field

ATT&CK

ID Technique Tactic
T1546.003 Windows Management Instrumentation Event Subscription Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, administrators may use event subscriptions for legitimate purposes.

Reference

Test Dataset

version: 2

Web Fraud - Account Harvesting

This search is used to identify the creation of multiple user accounts using the same email domain name.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1136
  • Last Updated: 2018-10-08
details

Search

`stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/" 
| rex field=cookie "form_key=(?<SessionID>\w+)" 
| rex field=form_data "login\[username\]=(?<Username>[^&
|^$]+)" 
| search Username=* 
| rex field=Username "@(?<email_domain>.*)" 
| stats dc(Username) as UniqueUsernames list(Username) as src_user by email_domain 
| where UniqueUsernames> 25 
| `web_fraud___account_harvesting_filter`

Associated Analytic Story

  • Web Fraud Detection

How To Implement

We start with a dataset that provides visibility into the email address used for the account creation. In this example, we are narrowing our search down to the single web page that hosts the Magento2 e-commerce platform (via URI) used for account creation, the single http content-type to grab only the user's clicks, and the http field that provides the username (form_data), for performance reasons. After we have the username and email domain, we look for numerous account creations per email domain. Common data sources used for this detection are customized Apache logs or Splunk Stream.

Required field

ATT&CK

ID Technique Tactic
T1136 Create Account Persistence

Kill Chain Phase

  • Actions on Objectives

Known False Positives

As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamolous behavior. This search will need to be customized to fit your environment—improving its fidelity by counting based on something much more specific, such as a device ID that may be present in your dataset. Consideration for whether the large number of registrations are occuring from a first-time seen domain may also be important. Extending the search window to look further back in time, or even calculating the average per hour/day for each email domain to look for an anomalous spikes, will improve this search. You can also use Shannon entropy or Levenshtein Distance (both courtesy of URL Toolbox) to consider the randomness or similarity of the email name or email domain, as the names are often machine-generated.

Reference

Test Dataset

version: 1

Web Fraud - Anomalous User Clickspeed

This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1078
  • Last Updated: 2018-10-08
details

Search

`stream_http` http_content_type=text* 
| rex field=cookie "form_key=(?<session_id>\w+)" 
| streamstats window=2 current=1 range(_time) as TimeDelta by session_id 
| where TimeDelta>0 
|stats count stdev(TimeDelta) as ClickSpeedStdDev avg(TimeDelta) as ClickSpeedAvg by session_id 
| where count>5 AND (ClickSpeedStdDev<.5 OR ClickSpeedAvg<.5) 
| `web_fraud___anomalous_user_clickspeed_filter`

Associated Analytic Story

  • Web Fraud Detection

How To Implement

Start with a dataset that allows you to see clickstream data for each user click on the website. That data must have a time stamp and must contain a reference to the session identifier being used by the website. This ties the clicks together into clickstreams. This value is usually found in the http cookie. With a bit of tuning, a version of this search could be used in high-volume scenarios, such as scraping, crawling, application DDOS, credit-card testing, account takeover, etc. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.

Required field

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation

Kill Chain Phase

  • Actions on Objectives

Known False Positives

As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosly written detections that simply detect anamoluous behavior.

Reference

Test Dataset

version: 1

Web Fraud - Password Sharing Across Accounts

This search is used to identify user accounts that share a common password.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK:
  • Last Updated: 2018-10-08
details

Search

`stream_http` http_content_type=text* uri=/magento2/customer/account/loginPost*  
| rex field=form_data "login\[username\]=(?<Username>[^&
|^$]+)" 
| rex field=form_data "login\[password\]=(?<Password>[^&
|^$]+)" 
| stats dc(Username) as UniqueUsernames values(Username) as user list(src_ip) as src_ip by Password
|where UniqueUsernames>5 
| `web_fraud___password_sharing_across_accounts_filter`

Associated Analytic Story

  • Web Fraud Detection

How To Implement

We need to start with a dataset that allows us to see the values of usernames and passwords that users are submitting to the website hosting the Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized or hashed value of a password is acceptable and certainly preferable to a clear-text password. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.

Required field

ATT&CK

ID Technique Tactic

Kill Chain Phase

Known False Positives

As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior.

Reference

Test Dataset

version: 1

Web Servers Executing Suspicious Processes

This search looks for suspicious processes on all systems labeled as web servers.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1082
  • Last Updated: 2019-04-01
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.dest_category="web_server" AND (Processes.process="*whoami*" OR Processes.process="*ping*" OR Processes.process="*iptables*" OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*") by Processes.process Processes.process_name, Processes.dest Processes.user
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `web_servers_executing_suspicious_processes_filter`

Associated Analytic Story

  • Apache Struts Vulnerability

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, web servers will need to be identified in the Assets and Identity Framework of Enterprise Security.

Required field

ATT&CK

ID Technique Tactic
T1082 System Information Discovery Discovery

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.

Reference

Test Dataset

version: 1

Windows AdFind Exe

This search looks for the execution of adfind.exe with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • ATT&CK: T1018
  • Last Updated: 2020-12-16
details

Search

 
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process=*-f* OR Processes.process=*-b*) AND (Processes.process=*objectcategory* OR Processes.process=*-gcb* OR Processes.process=*-sc*) by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_adfind_exe_filter`

Associated Analytic Story

  • Sunburst Malware

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

ATT&CK

ID Technique Tactic
T1018 Remote System Discovery Discovery

Kill Chain Phase

  • Exploitation

Known False Positives

administrators rarely use adfind, usually not used for legitimate reasons

Reference

Test Dataset

version: 1

Windows Event Log Cleared

This search looks for Windows events that indicate one of the Windows event logs has been purged.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1070.001
  • Last Updated: 2020-07-06
details

Search

(`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` EventCode=104) 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_event_log_cleared_filter`

Associated Analytic Story

  • Windows Log Manipulation

  • Ransomware

How To Implement

To successfully implement this search, you need to be ingesting Windows event logs from your hosts.

Required field

ATT&CK

ID Technique Tactic
T1070.001 Clear Windows Event Logs Defense Evasion

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It is possible that these logs may be legitimately cleared by Administrators.

Reference

Test Dataset

version: 4

Windows Security Account Manager Stopped

The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • ATT&CK: T1489
  • Last Updated: 2020-11-06
details

Search


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `windows_security_account_manager_stopped_filter`

Associated Analytic Story

  • Ryuk Ransomware

How To Implement

You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

ATT&CK

ID Technique Tactic
T1489 Service Stop Impact

Kill Chain Phase

  • Delivery

Known False Positives

SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified.

Reference

Test Dataset

version: 1

Reference in New Issue View Git Blame Copy Permalink