Risky Based Analytics

detections/endpoint/account_discovery_with_net_app.yml

@@ -36,7 +36,7 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
   kill_chain_phases:
-  - Exploitation
+  - Reconnaissance
   mitre_attack_id:
   - T1087.002
   product:
@@ -54,3 +54,24 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 10
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 5
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_name
+    type: Process Name
+    role:
+    - Process

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -8,8 +8,8 @@ datamodel:
 - Endpoint
 description: This analytic detects a potential suspicious modification of firewall
   rule registry allowing inbound traffic in specific port with public profile. This
-  technique was seen in some attacker want to have a remote access to a machine by
-  allowing the traffic in firewall rule.
+  technique was identified when an adversary wants to grant remote access to a machine by
+  allowing the traffic in a firewall rule.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
   Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name =
@@ -47,3 +47,20 @@ tags:
   - Registry.dest
   - Registry.user
   security_domain: endpoint
+  impact: 10
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 3
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect suspicious powershell command to allow inbound
-  traffic in specific local port with public profile. This technique was seen in some
+description: The following analytic identifies suspicious PowerShell command to allow inbound
+  traffic inbound to a specific local port within the public profile. This technique was seen in some
   attacker want to have a remote access to a machine by allowing the traffic in firewall
   rule.
 search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message
@@ -42,3 +42,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 10
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 3
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -45,10 +45,10 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
   - Processes.process_name
   - Processes.process
   - Processes.process_id
+  - Processes.parent_process  
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect a potential privilege escalation attempt to
-  do malicious task. This registry modification is designed to  allows the Consent
-  Admin to perform an operation that requires elevation without consent or credentials.
+description: This analytic identifies a potential privilege escalation attempt to
+  perform malicious task. This registry modification is designed to allow the `Consent
+  Admin` to perform an operation that requires elevation without consent or credentials.
   We also found this in some attacker to gain privilege escalation to the compromise
   machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -48,3 +48,20 @@ tags:
   - Registry.registry_value_name
   - Registry.dest
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/anomalous_usage_of_7zip.yml

@@ -49,8 +49,34 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
+  - Processes.parent_process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/any_powershell_downloadfile.yml

@@ -48,8 +48,34 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
+  - Processes.parent_process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/any_powershell_downloadstring.yml

@@ -50,8 +50,31 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
+  - Processes.parent_process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -55,5 +55,36 @@ tags:
   - Processes.dest
   - Processes.user
   - Processes.process_name
-  - Processes.parent_process_name
+  - Processes.parent_process
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  - Stage:Recon
+  - Stage:Execution
+  message: An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+    - Attacker

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -9,8 +9,8 @@ datamodel:
 description: Attempt To Add Certificate To Untrusted Store
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil*
-  (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name
-  Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -20,7 +20,8 @@ how_to_implement: You must be ingesting data that records process activity from
 known_false_positives: There may be legitimate reasons for administrators to add a
   certificate to the untrusted certificate store. In such cases, this will typically
   be done on a large number of systems.
-references: []
+references: 
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
 tags:
   analytic_story:
   - Disabling Security Tools
@@ -47,8 +48,37 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
+  - Processes.process
   - Processes.parent_process
-  - Processes.user
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process