diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index d6b9650a94..52bebea07a 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -36,7 +36,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log kill_chain_phases: - - Exploitation + - Reconnaissance mitre_attack_id: - T1087.002 product: @@ -54,3 +54,24 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 10 + confidence: 50 + # (impact * confidence)/100 + risk_score: 5 + context: + - Source:Endpoint + - Stage:Discovery + message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Process \ No newline at end of file diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 7ed08711ab..e1d432f72c 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -8,8 +8,8 @@ datamodel: - Endpoint description: This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This - technique was seen in some attacker want to have a remote access to a machine by - allowing the traffic in firewall rule. + technique was identified when an adversary wants to grant remote access to a machine by + allowing the traffic in a firewall rule. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = @@ -47,3 +47,20 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 10 + confidence: 30 + # (impact * confidence)/100 + risk_score: 3 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 73acfefa3d..c79acb9f28 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious powershell command to allow inbound - traffic in specific local port with public profile. This technique was seen in some +description: The following analytic identifies suspicious PowerShell command to allow inbound + traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message @@ -42,3 +42,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 10 + confidence: 30 + # (impact * confidence)/100 + risk_score: 3 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index e6be861c52..4045e2272a 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -45,10 +45,10 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process - Processes.process_name - Processes.process - Processes.process_id + - Processes.parent_process - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 9cb0f6339a..b1b4570d80 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a potential privilege escalation attempt to - do malicious task. This registry modification is designed to allows the Consent - Admin to perform an operation that requires elevation without consent or credentials. +description: This analytic identifies a potential privilege escalation attempt to + perform malicious task. This registry modification is designed to allow the `Consent + Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -48,3 +48,20 @@ tags: - Registry.registry_value_name - Registry.dest security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 4de347be93..775ad9c6ee 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -49,8 +49,34 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name + - Processes.parent_process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Collection + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index afe2f0cf0b..70a92c57b3 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -48,8 +48,34 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name + - Processes.parent_process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 018246a866..c36455993b 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -50,8 +50,31 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name + - Processes.parent_process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 45b1a446f5..570229095c 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -55,5 +55,36 @@ tags: - Processes.dest - Processes.user - Processes.process_name - - Processes.parent_process_name + - Processes.parent_process + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Exploitation + - Stage:Recon + - Stage:Execution + message: An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + - Attacker diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 67dd384c0f..a4cd16deff 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -9,8 +9,8 @@ datamodel: description: Attempt To Add Certificate To Untrusted Store search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* - (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name - Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -20,7 +20,8 @@ how_to_implement: You must be ingesting data that records process activity from known_false_positives: There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md tags: analytic_story: - Disabling Security Tools @@ -47,8 +48,37 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name + - Processes.process - Processes.parent_process - - Processes.user + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 50 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 6c0655b9d5..a877bff6ad 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -11,7 +11,8 @@ description: This search looks for attempts to stop security-related services on search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* - stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user + stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' @@ -27,7 +28,8 @@ how_to_implement: You must be ingesting data that records the file-system activi services you would like to monitor for attempts to stop the service., known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service tags: analytic_story: - Disabling Security Tools @@ -55,8 +57,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 40 + confidence: 50 + # (impact * confidence)/100 + risk_score: 20 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index d6f1b914d4..b2496aee91 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) - by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, @@ -21,7 +21,8 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. known_false_positives: None identified. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets tags: analytic_story: - Credential Dumping @@ -46,7 +47,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index c5ce575bf0..31e1684ef1 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -53,3 +53,24 @@ tags: - Filesystem.user - Filesystem.file_path security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Execution + message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 505506d6dd..957fc2aa21 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -20,7 +20,7 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi data model in the Processes node. Tune based on parent process names. known_false_positives: Administrators may modify the boot configuration. references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair tags: analytic_story: - Ryuk Ransomware @@ -49,3 +49,28 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 100 + confidence: 80 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Impact + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index e455aba1d1..69a802660c 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -47,9 +47,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index e63975b329..5be9015d27 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -53,9 +53,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 2ec1788a60..fa1c083fac 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -45,9 +45,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Command and Control + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 90045fc832..ac7b9ec12c 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -46,9 +46,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Command and Control + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index f26bdc96b6..d6211c930b 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -11,10 +11,12 @@ description: This search looks for arguments to certutil.exe indicating the mani tokens specially inside Federated environments such as Windows ADFS. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe - Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name - Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' -how_to_implement: '' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. @@ -35,8 +37,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.parent_process + - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 70 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 4daa11119d..ebc556ff92 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -47,9 +47,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index d174940b40..db8ecf36e0 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect execution of cipher.exe to clear the unallocated - sectors of a specific disk. This technique was seen in some ransomwareto make it +description: this search is to detect execution of `cipher.exe` to clear the unallocated + sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe" @@ -15,13 +15,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: administrator may execute this app to manage disk references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ + - https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ + - https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf tags: analytic_story: - Ransomware @@ -38,12 +38,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id - - Processes.process_guid + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 100 + confidence: 90 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Impact + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 9e3a9f6e63..caebf8ad6f 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -17,13 +17,12 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process - = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process - Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` + = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Operators can execute third party tools using these parameters. references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html @@ -43,11 +42,41 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.process - - Processes.parent_process_name - _time - - Processes.process_name - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 100 + confidence: 100 + # (impact * confidence)/100 + risk_score: 100 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 7dcf383e02..8924772b76 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -44,3 +44,28 @@ tags: - OriginalFileName - process_path security_domain: endpoint + impact: 100 + confidence: 100 + # (impact * confidence)/100 + risk_score: 100 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index c1106006cd..88ed1346a3 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -44,9 +44,38 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index e6c7b05114..69f9f39c6b 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -46,3 +46,24 @@ tags: - Signed - ProcessId security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 4ca9db964b..e474099af8 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -68,3 +68,24 @@ tags: - process_path - process_id security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 2e0b65de31..2e47ea7e10 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -65,3 +65,25 @@ tags: - Filesystem.file_path - Filesystem.file_name security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Execution + Consequence: Data Destruction + message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index f0fd2e002a..e7a3b33a00 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -51,3 +51,25 @@ tags: - Filesystem.file_path - Filesystem.file_name security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Execution + Consequence: Data Destruction + message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index fcbca28a76..0c39677dc5 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -40,11 +40,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.dest Processes.user + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id - - Processes.process_guid + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 84f445454c..82ccb48ef1 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -46,9 +46,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index e397763cf0..a4113ec5e3 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -45,9 +45,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.parent_process - - Processs.process_name - - Processes.process - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index d2e325f42f..26829c725e 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -48,4 +48,22 @@ tags: - EventCode - TargetImage - TargetProcessId + - dest security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. + observable: + - name: TargetImage + type: Other + role: + - Other + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/create_service_in_suspicious_file_path.yml index 8da97e16a6..38e78ee390 100644 --- a/detections/endpoint/create_service_in_suspicious_file_path.yml +++ b/detections/endpoint/create_service_in_suspicious_file_path.yml @@ -29,7 +29,6 @@ tags: kill_chain_phases: - Privilege Escalation mitre_attack_id: - - T1569.001 - T1569.002 product: - Splunk Enterprise @@ -43,3 +42,20 @@ tags: - Service_Name - Service_Start_Type security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: Service_Name + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 97bc078628..5aafcb0286 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: Detect the hands on keyboard behavior of Windows Task Manager creating - a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification + a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. @@ -54,3 +54,28 @@ tags: - Computer - object_category security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: TargetFilename + type: File Name + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 7b2fdfb622..732098f893 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -45,11 +45,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index a61e3fdb17..eda44bfe58 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -41,8 +41,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 7653ea932e..559ce7e521 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -44,11 +44,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 3a7d2528de..9b6128ea60 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -42,11 +42,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 45654fa208..427eec0522 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -45,3 +45,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 1518f92ff7..01c56b9ca1 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -43,10 +43,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - Processes.dest - Processes.user - - Processes.parent_process_name + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id - - Processes.parent_process + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 4209216b6d..aa60567897 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -51,10 +51,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - - Processes.parent_process_name - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 27c04e1afd..7b2aedb501 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -50,3 +50,24 @@ tags: - user - dest security_domain: access + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: EventCode + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index f3112ae042..b09603c10f 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -47,9 +47,38 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 053214f054..1d18d9179e 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -54,3 +54,24 @@ tags: - process_id - file_create_time security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Discovery + message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index 2cd5d2de88..982ccf9602 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -45,3 +45,24 @@ tags: - TargetDomainName - user security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: EventCode + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 2c29b0c714..edc811df0d 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -58,3 +58,24 @@ tags: - TargetImage - TargetProcessId security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. + observable: + - name: source_image + type: Other + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: TargetImage + type: Other + role: + - Victim diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index ed1a8281fd..9179dd63bb 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -8,7 +8,7 @@ datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output - to Windows event logs. Dependent upon volume, enable no critical endpoints or all. + to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. @@ -57,3 +57,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + message: The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 1c1581db8c..9e3b33b230 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -56,3 +56,20 @@ tags: - All_Changes.result - All_Changes.dest security_domain: access + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Credential Access + message: Multiple accounts have been locked out. Review $dest$ and results related to $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 087893be3e..da873d1531 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -44,3 +44,20 @@ tags: - nodename - All_Changes.user security_domain: access + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Credential Access + message: Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. + observable: + - name: user + type: User + role: + - Victim + - name: result + type: Other + role: + - Victim diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 65c47b13d3..a782ceca40 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -53,3 +53,24 @@ tags: - Filesystem.file_hash - Filesystem.user security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Exploitation + message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 80bb170475..23b0f2cf87 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -61,3 +61,28 @@ tags: - process_path - CommandLine security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 979134d257..3798beb2cc 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -55,12 +55,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - Processes.dest - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index f7cf29ee5f..e75a78b101 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -57,11 +57,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 484268fc4a..136ac767ec 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -59,10 +59,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 567c7f6913..9535fda6e1 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -56,3 +56,28 @@ tags: - Computer - Image security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Credential Access + message: A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Parent Process + role: + - Other + - name: Image + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 029c7e1def..7e8214f39c 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -54,3 +54,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Credential Access + message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index cf0143c90f..ea7abb1e9c 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -49,10 +49,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.user - - Processes.process_name - - Processes.parent_process_name - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 34972cca41..2a5cb2efb5 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -55,3 +55,28 @@ tags: - process_path - CommandLine security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 26183d67d0..ab70994059 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -50,9 +50,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 3475b05b9f..974714c678 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -48,4 +48,22 @@ tags: - Group_Name - member_id - dest + - user security_domain: access + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Persistence + message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index b330ccef74..a8b796c5b3 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -46,9 +46,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.user - - Processes.process_name - - Processes.process - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index cf874d103c..160eda3d93 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -49,9 +49,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - Processes.dest - - Processes.process_name - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 40 + confidence: 80 + # (impact * confidence)/100 + risk_score: 32 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index c75e68cbec..bd9a778f31 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -47,9 +47,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.parent_process_name - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 4853444bb1..7cb1a56328 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -16,8 +16,8 @@ description: This search looks for events where `PsExec.exe` is run with the `ac within the command line. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name - Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)`| + where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -55,8 +55,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - Processes.dest - - Processes.parent_process_name + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index af35807b1c..16d6865dbe 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -54,3 +54,28 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index b98d0fe9f8..c369f9d593 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -60,3 +60,28 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index cb935b0f85..6c3e720c69 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -61,3 +61,24 @@ tags: - dest_host - dest_ip security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 37cce4746c..708324c566 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -60,3 +60,28 @@ tags: - process_path - Computer security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 852c8379c1..c70806f735 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -60,3 +60,28 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index f58d167364..fa6e35b81f 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -60,3 +60,24 @@ tags: - src_ip - dest_host security_domain: Endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 47bbffd0a1..000e819ef7 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -61,3 +61,28 @@ tags: - process_path - Computer security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 038b0495f4..1f668f6db9 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -56,11 +56,40 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 2e22aba088..8bbff4ae9e 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -47,3 +47,28 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index d66e0892fd..f0282c12ec 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -57,3 +57,28 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 564bf81adb..f7e494eca1 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -50,3 +50,28 @@ tags: - CommandLine - dest security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index c769a95800..7a90d03aae 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -51,3 +51,28 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index ededc6777c..c881803914 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading advpack.dll It's possible other files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*advpack* by Processes.user Processes.process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,8 +53,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index ef478ee546..3c18b96368 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll It's possible other files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,8 +53,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 03925c4d56..38c9efcd55 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,8 +53,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 56418cd2fc..66ef2445cc 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -59,3 +59,17 @@ tags: - Processes.parent_process_name - Processes.parent_process security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion + message: Suspicious rundll32.exe inline HTA execution on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 55a66bff9d..1193cc70c4 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -57,3 +57,15 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 30 + confidence: 80 + risk_score: 24 + context: + - Source:Endpoint + - Stage:Discovery + message: Possible SharpHound command-Line arguments identified on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index cf4a258200..056b832c2b 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -65,3 +65,19 @@ tags: - process_id - file_create_time security_domain: endpoint + impact: 30 + confidence: 80 + risk_score: 24 + context: + - Source:Endpoint + - Stage:Discovery + message: Potential SharpHound file modifications identified on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 1271ab6adf..5a1a51c969 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -61,3 +61,15 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 80 + risk_score: 24 + context: + - Source:Endpoint + - Stage:Discovery + message: Potential SharpHound binary identified on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index a437f2bc42..bf3385df95 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -2,7 +2,7 @@ name: Detect Use of cmd exe to Launch Script Interpreters id: b89919ed-fe5f-492c-b139-95dbb162039e version: 4 date: '2020-07-21' -author: Bhavin Patel, Splunk +author: Bhavin Patel, Mauricio Velazco, Splunk type: batch datamodel: - Endpoint @@ -52,3 +52,17 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 70 + confidence: 50 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion + message: cmd.exe launching script interpreters on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 4ae958509f..1224aed466 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -60,3 +60,16 @@ tags: - Computer - User security_domain: endpoint + impact: 70 + confidence: 90 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + message: Possible malicious WMI Subscription created on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index c5dad1d238..441352c75f 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -48,3 +48,15 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 30 + confidence: 80 + risk_score: 24 + context: + - Source: Endpoint + - Stage: Defense Evasion + message: WevtUtil.exe used to disable Event Logging on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 692aff2d33..1a1c75030e 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to identifies modification of registry to disable the - regedit or registry tools of windows operating system. Since registry tool is a +description: This search identifies modification of registry to disable the + regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. @@ -47,3 +47,10 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + risk_score: 40 + context: + - Source: Endpoint + - Stage: Defense Evasion + message: Disabled Registry Tools \ No newline at end of file diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 19047251b2..cb90ed3d0d 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -2,12 +2,12 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: batch datamodel: - Endpoint -description: The following search is to idetifies a modification in registry to prevent - the user seeing all the files with hidden attributes. This event or techniques are +description: The following analytic is to identify a modification in the Windows registry to prevent + users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -50,3 +50,10 @@ tags: - Registry.dest - Registry.registry_value_nam security_domain: endpoint + impact: 40 + confidence: 100 + risk_score: 40 + context: + - Source: Endpoint + - Stage: Defense Evasion + message: Disabled 'Show Hidden Files' diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 704bdc192d..2eb7462bba 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -48,3 +48,10 @@ tags: - Registry.registry_value_name - Registry.dest Registry.user security_domain: endpoint + impact: 40 + confidence: 100 + risk_score: 40 + context: + - Source: Endpoint + - Stage: Defense Evasion + message: Disabled 'Windows App Hotkeys' \ No newline at end of file diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 72f6bb866a..4353463a32 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -55,3 +55,15 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + risk_score: 40 + context: + - Source: Endpoint + - Stage: Defense Evasion + message: Windows Defender real time behavior monitoring disabled on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 70875b59cf..5e5c5b7045 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -68,3 +68,20 @@ tags: - Registry.registry_value_nam risk_score: 40 security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Smartscreen was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 0f8e387eb5..167d7544aa 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -67,3 +67,20 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows command prompt was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 2fe1c66fb5..6c28a3509f 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -66,3 +66,20 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Control Panel was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 7a1234cb41..49a635af4f 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -71,3 +71,20 @@ tags: - Processes.parent_process_id risk_score: 40 security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Firewall was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index f9492ea998..b9633b7653 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -69,3 +69,20 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index 95bcd94f13..c87ed46cfc 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -69,3 +69,28 @@ tags: - Processes.parent_process risk_score: 40 security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 5d44c3f38f..bf3198ba73 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -69,3 +69,20 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 0d32139a67..a54ca8b0bf 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -72,3 +72,20 @@ tags: - Registry.action risk_score: 40 security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index c013b6efbd..8ba204f044 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -69,3 +69,20 @@ tags: - Registry.registry_value_name risk_score: 70 security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows registry was modified to disable system restore on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 8e84012bfb..3adcfa500a 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -68,3 +68,20 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Task Manager was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 1aa342dae6..681ca72282 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -52,3 +52,28 @@ tags: - dest_port - process_path security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 0e2e70d158..272cdbee03 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -50,8 +50,38 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index da85779daf..728d3688e5 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -47,3 +47,20 @@ tags: - TargetFilename - Hash security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Suspicious files were downloaded with the Telegram application on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 349876a1bc..ac23e8ffc4 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -59,8 +59,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 94140f45e3..cfc859c177 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -45,8 +45,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 8a49c832ac..270489f8ac 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -54,8 +54,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index cf666556d2..cecfdad271 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -58,3 +58,24 @@ tags: - Computer - parent_process_name security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index a205a09ecf..d2b79306e6 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -44,3 +44,20 @@ tags: - Registry.user - Registry.registry_value_name security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: RDP was moved to a non-standard port on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 112b7e82c4..4b319cbdd0 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -47,3 +47,20 @@ tags: - Security_ID - Message security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 254a89981b..f2e28b5fde 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -49,3 +49,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index f6ad6b0b6f..2aa2661235 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -50,3 +50,28 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index ae6783ebf5..72aa0d85ee 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -54,3 +54,28 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 824acc3be4..88b5d1e174 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -47,3 +47,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 321c5b6a45..8b5e3e7a08 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -45,3 +45,16 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Multiple processes were executed out of windows\temp within a short amount of time on $dest$. + observable: + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 932e6ea2d0..a0c1c000b2 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -55,3 +55,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 52a5537505..5a9edee5cf 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -50,3 +50,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 6517547594..4c861b9187 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -49,3 +49,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 4810bb92c0..cc5e031d21 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -47,3 +47,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index d4a28bb91b..e3e70cf567 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -19,14 +19,14 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*" +search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: False positives will be limited to +known_false_positives: False positives should be limited as day to day scripts do not use this method. references: - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.