splunk-security_content/dist/api/baselines.json

{"baselines": [{"name": "Baseline of blocked outbound traffic from AWS", "id": "fc0edd96-ff2b-48b0-9f1f-63da3782fd63", "version": 1, "date": "2018-05-07", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly.", "search": "`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Spike in blocked Outbound Traffic from your AWS"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "action", "src_ip", "dest_ip"], "security_domain": "network"}}, {"name": "Baseline Of Cloud Infrastructure API Calls Per User", "id": "1da5d5ea-4382-447d-98a9-87c358c95fcb", "version": 1, "date": "2020-09-07", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.", "search": "| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name(\"All_Changes\")` | eval HourOfDay=strftime(_time, \"%H\") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, \"%w\") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by \"user,HourOfDay,isWeekend\" into cloud_excessive_api_calls_v1 dist=norm show_density=true", "how_to_implement": "You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud User Activities"], "deployments": ["Weekly Model Rebuild 90 Day Lookback"], "detections": ["Abnormally High Number Of Cloud Infrastructure API Calls"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.user", "All_Changes.status"], "security_domain": "network"}}, {"name": "Baseline Of Cloud Instances Destroyed", "id": "a2f701f8-5296-4d74-829c-0b7eb346d549", "version": 1, "date": "2020-08-25", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window.", "search": "| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, \"%H\") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, \"%w\") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by \"HourOfDay,isWeekend\" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true", "how_to_implement": "You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\\\nMore information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"], "deployments": ["Weekly Model Rebuild 90 Day Lookback"], "detections": ["Abnormally High Number Of Cloud Instances Destroyed"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.status", "All_Changes.object_category"], "security_domain": "network"}}, {"name": "Baseline Of Cloud Instances Launched", "id": "b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc", "version": 1, "date": "2020-08-14", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.", "search": "| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, \"%H\") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, \"%w\") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by \"HourOfDay,isWeekend\" into cloud_excessive_instances_created_v1 dist=expon show_density=true", "how_to_implement": "You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\\\nMore information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "deployments": ["Weekly Model Rebuild 90 Day Lookback"], "detections": ["Abnormally High Number Of Cloud Instances Launched"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.status", "All_Changes.object_category"], "security_domain": "network"}}, {"name": "Baseline Of Cloud Security Group API Calls Per User", "id": "67b84d51-8329-4909-849f-8d38ce54260a", "version": 1, "date": "2020-09-07", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly.", "search": "| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name(\"All_Changes\")` | eval HourOfDay=strftime(_time, \"%H\") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, \"%w\") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by \"user,HourOfDay,isWeekend\" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true", "how_to_implement": "You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud User Activities"], "deployments": ["Weekly Model Rebuild 90 Day Lookback"], "detections": ["Abnormally High Number Of Cloud Security Group API Calls"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.user", "All_Changes.status", "All_Changes.object_category"], "security_domain": "network"}}, {"name": "Baseline of Command Line Length - MLTK", "id": "d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459", "version": 1, "date": "2019-05-08", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.", "search": "| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel", "how_to_implement": "You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Prohibited Applications Spawning cmd.exe", "Unusually Long Command Line - MLTK"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.user", "Processes.dest", "Processes.process_name", "Processes.process"], "security_domain": "endpoint"}}, {"name": "Baseline of DNS Query Length - MLTK", "id": "c914844c-0ff5-4efc-8d44-c063443129ba", "version": 1, "date": "2019-05-08", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Network_Resolution"], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.", "search": "| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel", "how_to_implement": "To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "deployments": ["Daily Cache Updates"], "detections": ["DNS Query Length Outliers - MLTK"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "DNS.query", "DNS.record_type"], "security_domain": "network"}}, {"name": "Baseline of Network ACL Activity by ARN", "id": "fc0edd96-ff2b-4810-9f1f-63da3783fd63", "version": 1, "date": "2018-05-21", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.", "search": "`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Network ACL Activity"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Spike in Network ACL Activity"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "userIdentity.arn"], "security_domain": "network"}}, {"name": "Baseline of S3 Bucket deletion activity by ARN", "id": "841b102c-8866-494b-a704-87b674fe9b09", "version": 1, "date": "2018-07-17", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.", "search": "`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious AWS S3 Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Spike in S3 Bucket deletion"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "userIdentity.arn"], "security_domain": "network"}}, {"name": "Baseline of Security Group Activity by ARN", "id": "fc0edd96-ff2b-48b0-9f1f-63da3783fd63", "version": 1, "date": "2018-04-17", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.", "search": "`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS User Monitoring"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Spike in Security Group Activity"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "userIdentity.arn"], "security_domain": "network"}}, {"name": "Baseline of SMB Traffic - MLTK", "id": "df98763b-0b08-4281-8ef9-08db7ac572a9", "version": 1, "date": "2019-05-08", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Network_Traffic"], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.", "search": "| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel", "how_to_implement": "You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding \"src\" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"], "deployments": ["Daily Cache Updates"], "detections": ["Processes launching netsh", "SMB Traffic Spike - MLTK"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Traffic.dest_port", "All_Traffic.app", "All_Traffic.src"], "security_domain": "network"}}, {"name": "Count of assets by category", "id": "dcfd6b40-42f9-469d-a433-2e53f7489ff9", "version": 1, "date": "2017-09-13", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search shows you every asset category you have and the assets that belong to those categories.", "search": "| from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count", "how_to_implement": "To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Asset Tracking"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Unauthorized Assets by MAC address"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Identity_Management.All_Assets", "category"], "security_domain": "endpoint"}}, {"name": "Count of Unique IPs Connecting to Ports", "id": "9f3bae5a-9fe3-49df-8c84-5edc51d84b7f", "version": 1, "date": "2017-09-13", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Network_Traffic"], "description": "The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them.", "search": "| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name(\"All_Traffic\")` | sort - count", "how_to_implement": "To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "deployments": ["Daily Cache Updates"], "detections": ["Prohibited Network Traffic Allowed"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Traffic.dest_port", "All_Traffic.src"], "security_domain": "network"}}, {"name": "Create a list of approved AWS service accounts", "id": "08ef80f5-6555-474b-bb2d-22e2aa4206a4", "version": 2, "date": "2018-12-03", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file.", "search": "`cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS User Monitoring"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS API Activities From Unapproved Accounts"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "errorCode", "userName"], "security_domain": "network"}}, {"name": "Add Prohibited Processes to Enterprise Security", "id": "251930a5-1451-4428-bb13-eed5775be0ce", "version": 1, "date": "2017-09-15", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.", "search": "| inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes | stats count", "how_to_implement": "This search should be run on each new install of ESCU.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Emotet Malware  DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"], "deployments": ["Daily Cache Updates"], "detections": ["Prohibited Software On Endpoint"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time"], "security_domain": "endpoint"}}, {"name": "Baseline of API Calls per User ARN", "id": "4b5119c3-5369-4040-9430-b63b1a314229", "version": 1, "date": "2018-04-09", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.", "search": "`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS User Monitoring"], "deployments": ["Daily Cache Updates"], "detections": ["Detect Spike in AWS API Activity"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventType", "userIdentity.arn"], "security_domain": "network"}}, {"name": "Baseline of Excessive AWS Instances Launched by User - MLTK", "id": "fa5634df-fb05-4b4b-aba0-6115138bb1ba", "version": 1, "date": "2019-11-14", "author": "Jason Brewer, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window.", "search": "`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\\\nIn addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\\\nMore information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Abnormally High AWS Instances Launched by User - MLTK"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "errorCode", "src_user"], "security_domain": "network"}}, {"name": "Baseline of Excessive AWS Instances Terminated by User - MLTK", "id": "b28ed6de-e4ba-40f7-ae0a-93a088c774ab", "version": 1, "date": "2019-11-14", "author": "Jason Brewer, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window.", "search": "`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\\\nIn addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\\\nMore information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious AWS EC2 Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Abnormally High AWS Instances Terminated by User - MLTK"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "errorCode", "src_user"], "security_domain": "network"}}, {"name": "Previously seen API call per user roles in CloudTrail", "id": "02add098-efa3-428d-b2e2-4ed0831c92f4", "version": 1, "date": "2018-04-16", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role.", "search": "`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS User Monitoring"], "deployments": ["Daily Cache Updates"], "detections": ["Detect new API calls from user roles"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventType", "errorCode", "userIdentity.type", "userName", "eventName"], "security_domain": "network"}}, {"name": "Previously Seen AWS Provisioning Activity Sources", "id": "ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee", "version": 1, "date": "2018-03-16", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something.", "search": "`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Suspicious Provisioning Activities"], "deployments": ["Daily Cache Updates"], "detections": ["AWS Cloud Provisioning From Previously Unseen IP Address", "AWS Cloud Provisioning From Previously Unseen City", "AWS Cloud Provisioning From Previously Unseen Country", "AWS Cloud Provisioning From Previously Unseen Region"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "sourceIPAddress"], "security_domain": "network"}}, {"name": "Previously Seen EC2 AMIs", "id": "bb1bd99d-1e93-45f1-9571-cfed42d372b9", "version": 1, "date": "2018-03-12", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search builds a table of previously seen AMIs used to launch EC2 instances", "search": "`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Cryptomining"], "deployments": ["Daily Cache Updates"], "detections": ["EC2 Instance Started With Previously Unseen AMI"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "errorCode", "requestParameters.instancesSet.items{}.imageId"], "security_domain": "network"}}, {"name": "Previously Seen EC2 Instance Types", "id": "b8f029f2-65a6-4d76-be98-dad1c9d59c45", "version": 1, "date": "2018-03-08", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search builds a table of previously seen EC2 instance types", "search": "`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value=\"m1.small\" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Cryptomining"], "deployments": ["Daily Cache Updates"], "detections": ["EC2 Instance Started With Previously Unseen Instance Type"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "errorCode", "requestParameters.instanceType"], "security_domain": "network"}}, {"name": "Previously Seen EC2 Launches By User", "id": "6c767ac0-0906-4355-9a83-927f5ee7bdad", "version": 1, "date": "2018-03-15", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search builds a table of previously seen ARNs that have launched a EC2 instance.", "search": "`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "deployments": ["Daily Cache Updates"], "detections": ["EC2 Instance Started With Previously Unseen User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "errorCode", "requestParameters.instanceType"], "security_domain": "network"}}, {"name": "Previously seen users in CloudTrail", "id": "fc0edc95-ff2b-48b0-9f6f-63da3789fd03", "version": 1, "date": "2018-04-30", "author": "Jason Brewer, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel", "search": "`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE \"\",src,City),Region=if(Region LIKE \"\",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious AWS Login Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect new user AWS Console Login"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "userIdentity.arn", "src"], "security_domain": "network"}}, {"name": "Update previously seen users in CloudTrail", "id": "06c036e6-d6d7-4daa-bd76-411c3d356031", "version": 1, "date": "2018-04-30", "author": "Jason Brewer, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel", "search": "`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE \"\",src,City),Region=if(Region LIKE \"\",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious AWS Login Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect new user AWS Console Login"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "userIdentity.arn", "src"], "security_domain": "network"}}, {"name": "Discover DNS records", "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", "version": 1, "date": "2019-02-14", "author": "Jose Hernandez, Splunk", "type": "Baseline", "datamodel": ["Network_Resolution"], "description": "The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup", "search": "| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \"\\*\", \"\")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer |  makemv delim=\" \" type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records", "how_to_implement": "To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["DNS Hijacking"], "deployments": ["Daily Cache Updates"], "detections": ["DNS record changed"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "DNS.record_type", "DNS.answer", "DNS.query"], "security_domain": "network"}}, {"name": "DNSTwist Domain Names", "id": "19f7d2ec-6028-4d01-bcdb-bda9a034c17f", "version": 2, "date": "2018-10-08", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches.", "search": "| dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse=\"true\" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count", "how_to_implement": "To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\\_SA\\_CIM**.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Brand Monitoring", "Suspicious Emails"], "deployments": ["Daily Cache Updates"], "detections": ["Monitor Email For Brand Abuse", "Monitor DNS For Brand Abuse", "Monitor Web Traffic For Brand Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time"], "security_domain": "network"}}, {"name": "Identify Systems Creating Remote Desktop Traffic", "id": "5cdda34f-4caf-4128-a713-0837fc48b67a", "version": 1, "date": "2017-09-15", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Network_Traffic"], "description": "This search counts the numbers of times the system has generated remote desktop traffic.", "search": "| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name(\"All_Traffic\")` | sort - count", "how_to_implement": "To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"], "deployments": ["Daily Cache Updates"], "detections": ["Remote Desktop Network Traffic"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Traffic.dest_port", "All_Traffic.src"], "security_domain": "network"}}, {"name": "Identify Systems Receiving Remote Desktop Traffic", "id": "baaeea15-fe8a-4090-92c2-5b60943bb608", "version": 1, "date": "2017-09-15", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Network_Traffic"], "description": "This search counts the numbers of times the system has created remote desktop traffic", "search": "| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name(\"All_Traffic\")` | sort - count", "how_to_implement": "To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"], "deployments": ["Daily Cache Updates"], "detections": ["Remote Desktop Network Traffic"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Traffic.dest_port", "All_Traffic.dest"], "security_domain": "network"}}, {"name": "Identify Systems Using Remote Desktop", "id": "063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8", "version": 1, "date": "2019-04-01", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Endpoint"], "description": "This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system.", "search": "| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name=\"*mstsc.exe*\" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count", "how_to_implement": "To successfully implement this search you must be ingesting endpoint data that records process activity.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"], "deployments": ["Daily Cache Updates"], "detections": ["Remote Desktop Network Traffic"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}}, {"name": "Monitor Successful Backups", "id": "b4d0dfb2-2195-4f6e-93a3-48468ed9734e", "version": 1, "date": "2017-09-12", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate.", "search": "`netbackup` \"Disk/Partition backup completed successfully.\" | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE", "how_to_implement": "To successfully implement this search you must be ingesting your backup logs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Monitor Backup Solution"], "deployments": ["Daily Cache Updates"], "detections": ["Unsuccessful Netbackup backups"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time"], "security_domain": "endpoint"}}, {"name": "Monitor Unsuccessful Backups", "id": "b2178fed-592f-492b-b851-74161678aa56", "version": 1, "date": "2017-09-12", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is intended to give you a feel for how often backup failures happen in your environments.  Fluctuations in these numbers will allow you to determine when you should investigate.", "search": "`netbackup` \"An error occurred, failed to backup.\" | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE", "how_to_implement": "To successfully implement this search you must be ingesting your backup logs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Monitor Backup Solution"], "deployments": ["Daily Cache Updates"], "detections": ["Unsuccessful Netbackup backups"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time"], "security_domain": "endpoint"}}, {"name": "Previously Seen AWS Cross Account Activity", "id": "1cc22b09-c867-416e-a511-cb36ac44aee2", "version": 1, "date": "2018-06-04", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.", "search": "`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Cross Account Activity"], "deployments": ["Daily Cache Updates"], "detections": ["AWS Cross Account Activity From Previously Unseen Account"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "eventName", "userIdentity.accountId", "resources{}.accountId"], "security_domain": "network"}}, {"name": "Previously Seen AWS Cross Account Activity - Initial", "id": "82af2ed9-8f4b-4785-a152-ba61e6a23bbf", "version": 1, "date": "2020-08-15", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role |  `drop_dm_object_name(Authentication)` | rex field=user_role \"arn:aws:sts:*:(?<dest_account>.*):\" |  where  vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["90 Day Baseline"], "detections": ["AWS Cross Account Activity From Previously Unseen Account"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.vendor_account", "Authentication.user", "Authentication.src", "Authentication.user_role"], "security_domain": "network"}}, {"name": "Previously Seen AWS Cross Account Activity - Update", "id": "dd6fb3a9-4906-48cb-8626-c88a25a056c3", "version": 1, "date": "2020-08-15", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role \"arn:aws:sts:*:(?<dest_account>.*):\" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["AWS Cross Account Activity From Previously Unseen Account"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.vendor_account", "Authentication.user", "Authentication.src", "Authentication.user_role"], "security_domain": "network"}}, {"name": "Previously Seen AWS Regions", "id": "fc0edc95-ff2b-48b0-9f6f-63da3789fd63", "version": 1, "date": "2018-01-08", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days", "search": "`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "deployments": ["Daily Cache Updates"], "detections": ["EC2 Instance Started In Previously Unseen Region"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "awsRegion"], "security_domain": "network"}}, {"name": "Previously Seen Cloud API Calls Per User Role - Initial", "id": "69d75f4b-b794-4a66-a777-730357b886b4", "version": 1, "date": "2020-09-03", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name(\"All_Changes\")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role", "how_to_implement": "You must be ingesting Cloud infrastructure logs from your cloud provider.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud User Activities"], "deployments": ["90 Day Baseline"], "detections": ["Cloud API Calls From Previously Unseen User Roles"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.user_type", "All_Changes.status", "All_Changes.user", "All_Changes.command"], "security_domain": "network"}}, {"name": "Previously Seen Cloud API Calls Per User Role - Update", "id": "c4b760a0-6a97-47e9-b089-8ae9e57f210e", "version": 1, "date": "2020-09-03", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search updates the table of the first and last times seen for every user role and command combination.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name(\"All_Changes\")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role", "how_to_implement": "You must be ingesting Cloud infrastructure logs from your cloud provider.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud User Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud API Calls From Previously Unseen User Roles"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.user_type", "All_Changes.status", "All_Changes.user", "All_Changes.command"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Compute Creations By User - Initial", "id": "dd4ced8a-15a9-4285-94ac-7e4134673bf8", "version": 1, "date": "2020-08-15", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen users that have launched a cloud compute instance.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name(\"All_Changes\")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["Hourly Cache Updates"], "detections": ["Cloud Compute Instance Created By Previously Unseen User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.object_category", "All_Changes.user"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Compute Creations By User - Update", "id": "6bf75d69-7766-47bc-8097-e41696807a6f", "version": 1, "date": "2020-08-15", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen users that have launched a cloud compute instance.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name(\"All_Changes\")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), \"-90d@d\") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud Compute Instance Created By Previously Unseen User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.object_category", "All_Changes.user"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Compute Images - Initial", "id": "7744597f-d07a-4cea-94a7-e0f8aaebc410", "version": 1, "date": "2020-10-08", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen images used to launch cloud compute instances", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created  by All_Changes.Instance_Changes.image_id | `drop_dm_object_name(\"All_Changes\")` | `drop_dm_object_name(\"Instance_Changes\")` | where image_id != \"unknown\" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | outputlookup previously_seen_cloud_compute_images", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["90 Day Baseline"], "detections": ["Cloud Compute Instance Created With Previously Unseen Image"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.Instance_Changes.image_id"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Compute Images - Update", "id": "6f1ca5dc-e445-401c-9845-a96d2b6ba184", "version": 1, "date": "2020-08-12", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen images used to launch cloud compute instances", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name(\"All_Changes\")` | `drop_dm_object_name(\"Instance_Changes\")` | where image_id != \"unknown\" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | outputlookup previously_seen_cloud_compute_images", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud Compute Instance Created With Previously Unseen Image"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.Instance_Changes.image_id"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Compute Instance Types - Initial", "id": "3c78025c-1ffe-4976-a640-75ef604842be", "version": 1, "date": "2020-9-03", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen cloud compute instance types", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name(\"All_Changes.Instance_Changes\")` | where instance_type != \"unknown\" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-14d@d\"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["90 Day Baseline"], "detections": ["Cloud Compute Instance Created With Previously Unseen Instance Type"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.Instance_Changes.instance_type"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Compute Instance Types - Update", "id": "7b7ef9ab-acb9-4e07-af76-4cf1e722885c", "version": 1, "date": "2020-9-03", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen cloud compute instance types", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name(\"All_Changes.Instance_Changes\")` | where instance_type != \"unknown\" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-14d@d\"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud Compute Instance Created With Previously Unseen Instance Type"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.Instance_Changes.instance_type"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Instance Modifications By User - Initial", "id": "f36dc403-739d-42f3-83a3-49237d8654c5", "version": 1, "date": "2020-07-29", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of previously seen users that have modified a cloud instance.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name(\"All_Changes\")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Instance Activities"], "deployments": ["90 Day Baseline"], "detections": ["Cloud Instance Modified By Previously Unseen User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.change_type", "All_Changes.status", "All_Changes.user"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Instance Modifications By User - Update", "id": "534b7d30-7b0c-4510-8f55-65439850d58d", "version": 1, "date": "2020-07-29", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search updates a table of previously seen Cloud Instance modifications that have been made by a user", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name(\"All_Changes\")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Instance Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud Instance Modified By Previously Unseen User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.change_type", "All_Changes.status", "All_Changes.user"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Provisioning Activity Sources - Initial", "id": "4ce865fc-f43e-4521-a8ed-ab8af99052d7", "version": 1, "date": "2020-08-19", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name(\"All_Changes\")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources", "how_to_implement": "You must be ingesting Cloud infrastructure logs from your cloud provider.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "deployments": ["90 Day Baseline"], "detections": ["Cloud Provisioning Activity From Previously Unseen IP Address", "Cloud Provisioning Activity From Previously Unseen City", "Cloud Provisioning Activity From Previously Unseen Country", "Cloud Provisioning Activity From Previously Unseen Region"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.src", "All_Changes.status"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Provisioning Activity Sources - Update", "id": "9830abb9-be80-4563-b232-09bf1f628cf3", "version": 1, "date": "2020-08-20", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something.  It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached.", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name(\"All_Changes\")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-7d@d\"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources", "how_to_implement": "You must be ingesting Cloud infrastructure logs from your cloud provider.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud Provisioning Activity From Previously Unseen IP Address", "Cloud Provisioning Activity From Previously Unseen City", "Cloud Provisioning Activity From Previously Unseen Country", "Cloud Provisioning Activity From Previously Unseen Region"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.src", "All_Changes.status"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Regions - Initial", "id": "b5e232db-dec6-4db8-aaa1-dd5474521e40", "version": 1, "date": "2020-09-02", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name(\"All_Changes\")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-14d@d\"), 1, 0) | outputlookup previously_seen_cloud_regions", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["90 Day Baseline"], "detections": ["Cloud Compute Instance Created In Previously Unused Region"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.vendor_region"], "security_domain": "network"}}, {"name": "Previously Seen Cloud Regions - Update", "id": "512f928a-a461-41b4-8984-db4dd2c472e4", "version": 1, "date": "2020-09-02", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days", "search": "| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name(\"All_Changes\")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), \"-14d@d\"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count", "how_to_implement": "You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Cloud Cryptomining"], "deployments": ["Daily Cache Updates"], "detections": ["Cloud Compute Instance Created In Previously Unused Region"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.action", "All_Changes.vendor_region"], "security_domain": "network"}}, {"name": "Previously seen command line arguments", "id": "56059acf-50fe-4f60-98d1-b75b51b5c2f3", "version": 2, "date": "2019-03-01", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": ["Endpoint"], "description": "This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days.", "search": "| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process=\"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`", "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "IcedID"], "deployments": ["Daily Cache Updates"], "detections": ["First time seen command line argument"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.process_name", "Processes.process"], "security_domain": "endpoint"}}, {"name": "Previously Seen EC2 Modifications By User", "id": "4d69091b-d975-4267-85df-888bd41034eb", "version": 1, "date": "2018-04-05", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search builds a table of previously seen ARNs that have launched a EC2 instance.", "search": "`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Unusual AWS EC2 Modifications"], "deployments": ["Daily Cache Updates"], "detections": ["EC2 Instance Modified With Previously Unseen User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "userIdentity.arn", "errorCode"], "security_domain": "network"}}, {"name": "Previously Seen Running Windows Services - Initial", "id": "64ce0ade-cb01-4678-bddd-d31c0b175394", "version": 3, "date": "2020-06-23", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This collects the services that have been started across your entire enterprise.", "search": "`wineventlog_system` EventCode=7036 | rex field=Message \"The (?<service>[-\\(\\)\\s\\w]+) service entered the (?<state>\\w+) state\" | where state=\"running\" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services", "how_to_implement": "While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"], "deployments": ["90 Day Baseline"], "detections": ["First Time Seen Running Windows Service"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "EventCode", "Message"], "security_domain": "endpoint"}}, {"name": "Previously Seen Running Windows Services - Update", "id": "2e3bdd68-1863-46ee-81f8-87273eee7f1c", "version": 3, "date": "2020-06-23", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached.", "search": "`wineventlog_system` EventCode=7036 | rex field=Message \"The (?<service>[-\\(\\)\\s\\w]+) service entered the (?<state>\\w+) state\" | where state=\"running\" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), \"`previously_seen_windows_service_forget_window`\") | outputlookup previously_seen_running_windows_services", "how_to_implement": "While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"], "deployments": ["Hourly Cache Updates"], "detections": ["First Time Seen Running Windows Service"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "EventCode", "Message"], "security_domain": "endpoint"}}, {"name": "Previously seen S3 bucket access by remote IP", "id": "54c40c6a-9a5b-4a79-9291-85977f713961", "version": 1, "date": "2018-06-28", "author": "Bhavin Patel, Splunk", "type": "Baseline", "datamodel": [], "description": "This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is \"200\"", "search": "`aws_s3_accesslogs` http_status=200  | stats  earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count", "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious AWS S3 Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect S3 access from a new IP"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "http_status", "bucket_name", "remote_ip"], "security_domain": "network"}}, {"name": "Previously Seen Users in CloudTrail - Initial", "id": "0a87ecf9-dc6a-43af-861a-205e75a09bf5", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["90 Day Baseline"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}, {"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}, {"name": "Previously Seen Zoom Child Processes - Initial", "id": "60b9c00f-a9d6-4e51-803c-5d63ea21b95b", "version": 1, "date": "2020-05-20", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Endpoint"], "description": "This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached.", "search": "| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Zoom Child Processes"], "deployments": ["90 Day Baseline"], "detections": ["First Time Seen Child Process of Zoom"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}}, {"name": "Previously Seen Zoom Child Processes - Update", "id": "80aea7fd-5da2-4533-b3c2-560533bfbaee", "version": 1, "date": "2020-05-20", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Endpoint"], "description": "This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk.", "search": "| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), \"`previously_seen_zoom_child_processes_forget_window`\") | outputlookup zoom_first_time_child_process", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Zoom Child Processes"], "deployments": ["Hourly Cache Updates"], "detections": ["First Time Seen Child Process of Zoom"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}}, {"name": "Systems Ready for Spectre-Meltdown Windows Patch", "id": "fc0edc95-ff2b-48b0-9f6f-63da3789fd61", "version": 1, "date": "2018-01-08", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": ["Change"], "description": "Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path=\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\QualityCompat*\") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(\"All_Changes\")`", "how_to_implement": "You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "deployments": ["Daily Cache Updates"], "detections": ["Spectre and Meltdown Vulnerable Systems"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "All_Changes.object_category", "All_Changes.object_path", "All_Changes.dest", "All_Changes.command", "All_Changes.user", "All_Changes.object"], "security_domain": "endpoint"}}, {"name": "Windows Updates Install Failures", "id": "6a4dbd1b-4502-4a11-943a-82b5ae7a42d7", "version": 1, "date": "2017-09-14", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned.", "search": "| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product=\"Microsoft Windows\" AND Updates.status=failure by _time span=1d", "how_to_implement": "You must be ingesting your Windows Update Logs", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Monitor for Updates"], "deployments": ["Daily Cache Updates"], "detections": ["No Windows Updates in a time frame"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Updates.vendor_product", "Updates.status"], "security_domain": "endpoint"}}, {"name": "Windows Updates Install Successes", "id": "6a80535c-86a6-4b54-894c-4b446d0c701d", "version": 1, "date": "2017-09-14", "author": "David Dorsey, Splunk", "type": "Baseline", "datamodel": [], "description": "This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned.", "search": "| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product=\"Microsoft Windows\" AND Updates.status=installed by _time span=1d", "how_to_implement": "You must be ingesting your Windows Update Logs", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Monitor for Updates"], "deployments": ["Daily Cache Updates"], "detections": ["No Windows Updates in a time frame"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Updates.vendor_product", "Updates.status"], "security_domain": "endpoint"}}]}