20 description and how to implement

detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml

@@ -1,13 +1,11 @@
 name: Allow File And Printing Sharing In Firewall
 id: ce27646e-d411-11eb-8a00-acde48001122
-version: 2
-date: '2021-06-23'
+version: 3
+date: '2023-07-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This search is to detect a suspicious modification of firewall to allow
-  file and printer sharing. This technique was seen in ransomware to be able to discover
-  more machine connected to the compromised host to encrypt more files
+description: The following analytic is designed to detect any suspicious modification of the firewall settings that enables file and printer sharing. This behavior is commonly seen in ransomware attacks, where the attackers attempt to discover more machines connected to the compromised host in order to encrypt more files. The analytic is implemented using a Splunk query that leverages the `Endpoint.Processes` datamodel and `process_netsh` to search for any processes related to firewall settings modifications. The query specifically looks for processes that contain the keywords "*firewall*", "*group="File and Printer Sharing"*", and "*enable=Yes*". If a true positive is found, it indicates that an attacker has attempted to modify the firewall settings to enable file and printer sharing, which could lead to data theft or further damage. Therefore, it is important for a SOC to identify this behavior and take immediate action to prevent any potential threats. In conclusion, this analytic is crucial for detecting any suspicious firewall settings modifications and helps SOC analysts to identify potential threats earlier, allowing them to take necessary measures to mitigate the risks.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -17,11 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
@@ -34,7 +28,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: ''
+  message: Suspicious modification of the firewall settings that enables file and printer sharing detected on $dest$
   mitre_attack_id:
   - T1562.007
   - T1562

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -1,14 +1,11 @@
 name: Allow Network Discovery In Firewall
 id: ccd6a38c-d40b-11eb-85a5-acde48001122
-version: 2
-date: '2021-06-23'
+version: 3
+date: '2023-07-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This search is to detect a suspicious modification to the firewall to
-  allow network discovery on a machine. This technique was seen in couple of ransomware
-  (revil, reddot) to discover other machine connected to the compromised host to encrypt
-  more files.
+description: The following analytic aims to detect suspicious modifications to the firewall that allow network discovery on a machine. This behavior is commonly used by ransomware, such as Revil and Reddot, to discover other machines connected to the compromised host and encrypt more files. The analytic is implemented using a Splunk query that utilizes the datamodel "Endpoint.Processes" and looks for processes that include the terms "*firewall*", "*group=\"Network Discovery\"*", "*enable*", and "*Yes*". The query counts the occurrences of these processes and provides information on the destination, user, parent process, process name, process ID, and parent process ID. Identifying this behavior is crucial for a SOC because it can indicate that an attacker is attempting to spread their attack across the network. If a true positive is detected, it suggests that the attacker has compromised the machine and is attempting to discover other machines to infect. The impact of the attack could result in the encryption of more files, data theft, or other malicious outcomes. To implement this analytic, ensure that you are collecting firewall logs and ingesting them into Splunk. It is important to note that legitimate uses of network discovery may cause false positives, so triage is necessary to confirm the activity is malicious. Upon triage, review the source of the process and investigate any relevant on-disk artifacts. Identifying this behavior early can help mitigate the risk of further damage and prevent the spread of the attack to other machines on the network.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -18,11 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
@@ -36,7 +29,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: ''
+  message: Suspicious modifications to the firewall that allow network discovery detected on host $dest$
   mitre_attack_id:
   - T1562.007
   - T1562
@@ -62,7 +55,7 @@ tags:
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
-  risk_score: 25.0
+  risk_score: 25
   security_domain: endpoint
 tests:
 - name: True Positive Test

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -1,11 +1,11 @@
 name: Attacker Tools On Endpoint
 id: a51bfe1a-94f0-48cc-b4e4-16a110145893
-version: 2
-date: '2021-11-04'
+version: 3
+date: '2023-07-13'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
-description: The following analytic aims to identify the use of tools commonly exploited by cybercriminals. The use of these tools often signals nefarious activities like unauthorized access, network scanning, or data exfiltration, representing a significant threat to an organization's security infrastructure. By examining process activity on the host, particularly those processes corresponding to known attacker tool names, this analytic serves as an early warning system for potential security incidents. However, its precision must be balanced with the understanding that some administrative activities might also trigger alerts, resulting in false positives. This underlines the importance of cyber analysts having a clear understanding of typical endpoint activities and behaviors within their organization, enabling them to accurately interpret and respond to these alerts.
+description: The following analytic is designed to detect the use of tools that are commonly exploited by cybercriminals. These tools are often associated with malicious activities such as unauthorized access, network scanning, or data exfiltration, posing a significant threat to an organization's security infrastructure. To identify these activities, the analytic examines the process activity on the host, specifically focusing on processes that are known to be associated with attacker tool names. By doing so, it acts as an early warning system for potential security incidents, allowing security operations teams to respond promptly. However, it's important to note that while this analytic is effective in detecting malicious behavior, it may also generate false positives due to legitimate administrative activities that may resemble malicious actions. Therefore, it is crucial for cyber analysts to have a comprehensive understanding of typical endpoint activities and behaviors within their organization. This knowledge enables them to accurately interpret and respond to the alerts generated by this analytic, ensuring a proper balance between precision and minimizing false positives. Overall, implementing this analytic provides organizations with enhanced visibility into potential security threats, enabling proactive detection and response to mitigate the risks associated with cybercriminal activities.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,12 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
   process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is usually generated via logs that report process tracking
-  in your Windows audit settings.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some administrator activity can be potentially triggered, please
   add those users to the filter macro.
 references: []

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -1,11 +1,11 @@
 name: Attempt To Add Certificate To Untrusted Store
 id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-version: 7
-date: '2021-09-16'
+version: 8
+date: '2023-07-13'
 author: Patrick Bareiss, Rico Valdez, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to detect potential security threats involving the misuse of system trust. It works by detecting events where a process attempts to add a certificate to the untrusted certificate store, an action often associated with disabling security tools. The analytic uses Sysmon Event ID 1 data source, particularly focusing on process activities and command-line arguments related to 'certutil -addstore'. It's essential to ingest data that records process activity and logs containing process names and command lines for its effective operation. Be aware, sometimes administrators might legitimately perform this action. The analytic's value lies in detecting isolated or unexpected instances, indicative of potential malicious activities. Cybersecurity analysts should understand the importance of trust mechanisms and their subversion in system security.
+description: The identified behavior that this analytic detects is when a process attempts to add a certificate to the untrusted certificate store. This action is often associated with disabling security tools and is considered a potential security threat. The analytic focuses on process activities and command-line arguments related to the 'certutil -addstore' command. By monitoring and analyzing this data, the analytic can identify instances where this behavior occurs. Identifying this behavior is worth it for a Security Operations Center (SOC) because it can indicate potential malicious activities. Adding a certificate to the untrusted certificate store is often done by attackers to disable security tools and gain unauthorized access to a system. By detecting and investigating these instances, the SOC can take appropriate action to prevent further compromise and protect the organization's assets. If a true positive is detected, it suggests that an attacker is attempting to subvert the system's trust mechanisms and potentially disable security tools. The impact of such an attack can be severe, including unauthorized access, data theft, and potential compromise of the entire system or network. By identifying and responding to these threats promptly, the SOC can mitigate the risks and minimize the potential damage. It is important to note that there may be legitimate reasons for a process to add a certificate to the untrusted certificate store, such as system administration tasks. However, the value of this analytic lies in detecting isolated or unexpected instances of this behavior, which are indicative of potential malicious activities. In order to effectively implement this analytic, it is crucial to ingest data that records process activity and logs containing process names and command lines. This will provide the necessary information for the analytic to analyze and detect potential threats. Analysts should also be aware of the possibility of false positives and should conduct thorough triage and investigation before taking any action. Overall, this analytic helps cybersecurity analysts detect and respond to potential threats involving the misuse of system trust mechanisms. By understanding the importance of trust and its subversion in system security, analysts can better protect their organizations from malicious activities.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
@@ -14,11 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `attempt_to_add_certificate_to_untrusted_store_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: There may be legitimate reasons for administrators to add a
   certificate to the untrusted certificate store. In such cases, this will typically
   be done on a large number of systems.