update per review comments

Author: xlinsplunk

baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml

@@ -0,0 +1,84 @@
+name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline
+id: 273df2f7-643a-451a-8d4d-637e39eadc87
+version: 1
+date: '2022-05-27'
+author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
+type: Baseline
+datamodel:
+- Splunk_Audit
+description: 'This search is to build a per user command and scripting risky SPL detection model using MLTK 
+  DensityFunction algorithm based on audit log data of Splunk apps. The model is built from past 7 days users 
+  history of running search commands from 
+  https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, 
+  and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of 
+  outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that 
+  boundary is smaller than 0.1%. This search should be scheduled to run at least as frequently as every 7 days.
+  The name of ML model generated is "risky_command_abuse" and should be configured to be globally shared (not
+  private) in MLTK app as ducumented here:
+  https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps
+  unless the same account of training this model will be used to perfeorm inference using this model for anomaly 
+  detection. '
+search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count 
+  FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
+  AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) 
+  AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
+  "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) 
+  AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
+  BY _time, Search_Activity.user span=1h 
+  | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" '
+how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky 
+  SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/
+  and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might 
+  take significant computing resources. It might requires dedicated search head. The underlined machine learning 
+  algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as 
+  max_fit_time, max_groups, etc. More details of achieving optmal performance abd configuring DensityFunction 
+  parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply
+  Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points 
+  to build a good bseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better
+  suit users' violation policy and their usage environment.
+known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density 
+  function model, false positives can occur, incorrectly labeling a long running search as potentially risky. 
+references:
+- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 6
+  confidence: 40
+  cve:
+  - CVE-2022-32154
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: ML model "risky_command_abuse" training is completed.
+  mitre_attack_id:
+  - T1059
+  nist:
+  - DE.AE
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Search_Activity.search
+  - Search_Activity.total_run_time 
+  - Search_Activity.user 
+  - Search_Activity.search_type
+  risk_score: 20
+  security_domain: audit
+  detections: 
+  - Splunk Command and Scripting Interpreter Risky SPL MLTK
+

baselines/splunk_risky_command_abuse_ml_detection_baseline.yml

@@ -1,30 +1,35 @@
-name: Splunk Risky Command Abuse ML Detection
+name: Splunk Command and Scripting Interpreter Risky SPL MLTK
 id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca
 version: 1
 date: '2022-05-27'
 author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
 type: Anomaly
 datamodel:
 - Splunk_Audit
-description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk 
-  Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour 
-  to detect whether a user has run searches containing risky keywords with abnormal long running time in the 
-  past two hours, comparing with his/her past seven days history. '
+description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk Command 
+  and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user 
+  has run searches containing risky SPL from this list 
+  https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga
+  with abnormal long running time in the past one hour, comparing with his/her past seven days history. This search 
+  uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier_= 0.0)'
 search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time,
   values(Search_Activity.search) as searches, count 
   FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
-  AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) 
+  AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) 
   AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
   "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) 
   AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
   BY _time, Search_Activity.user span=1h 
   | apply risky_command_abuse
   | fields _time, user, searches, run_time, IsOutlier(run_time)
   | rename IsOutlier(run_time) as isOutlier, _time as timestamp
-  | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`'
-how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. 
-known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of 
-  a search exceeds the boundaries of outlier defined by the fitted density function model. 
+  | where isOutlier>0.5 
+  | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`'
+how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ 
+  and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model
+  needs to be buillt using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run.
+known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density 
+  function model, false positives can occur, incorrectly labeling a long running search as potentially risky. 
 references:
 - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
 tags:
@@ -35,16 +40,18 @@ tags:
   - CIS 3
   - CIS 6
   confidence: 40
+  cve:
+  - CVE-2022-32154
   context:
   - Source:Endpoint
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
   impact: 50
   kill_chain_phases:
   - Actions on Objectives
-  message: $user used abnormally long run time for searches with risky command.
+  message: Abnormally long run time for risk SPL command seen by user $user.
   mitre_attack_id:
-  - T1203
+  - T1059
   nist:
   - DE.AE
   observable:
@@ -64,4 +71,4 @@ tags:
   - Search_Activity.search_type
   risk_score: 20
   security_domain: audit
-  
+  

…unk_risky_command_abuse_ml_detection.yml …scripting_interpreter_risky_spl_mltk.ymldetections/application/splunk_risky_command_abuse_ml_detection.yml renamed to detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml detections/application/splunk_risky_command_abuse_ml_detection.yml renamed to detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml

@@ -1,13 +1,13 @@
-name: Splunk Risky Command Abuse ML Detection Unit Test
+name: Splunk Command and Scripting Interpreter Risky SPL MLTK Unit Test
 tests:
-- name: Splunk Risky Command Abuse ML Detection
-  file: application/splunk_risky_command_abuse_ml_detection.yml
+- name: Splunk Command and Scripting Interpreter Risky SPL MLTK
+  file: splunk_command_and_scripting_interpreter_risky_spl_mltk.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -1h
   latest_time: now
   baselines:
-  - name: Splunk Risky Command Abuse ML Detection Baseline
-    file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml
+  - name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline
+    file: baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -7d
     latest_time: now