diff --git a/detections/detect_f5_tmui_rct_cve_2020_5902.yml b/detections/detect_f5_tmui_rct_cve_2020_5902.yml new file mode 100644 index 0000000000..3bdee0d446 --- /dev/null +++ b/detections/detect_f5_tmui_rct_cve_2020_5902.yml @@ -0,0 +1,35 @@ +name: Detect F5 TMUI RCE CVE_2020_5902 +id: 810e4dbc-d46e-11ea-87d0-0242ac130003 +version: 1 +date: '2020-08-02' +description: This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices +how_to_implement: To consistently detect exploit attempts on F5 devices using the vulnerabilities +contained within CVE-2020-5902 it is recommended to ingest logs via syslog. As many BIG-IP devices will +have SSL enabled on their management interfaces, detections via wire data may not pick anything up unless +you are decrypting SSL traffic in order to inspect it. I am using a regex string from a Cloudflare +mitigation technique to try and always catch the offending string (..;), along with the other exploit of using +(hsqldb;). +type: ESCU +references: +- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/ +- https://support.f5.com/csp/article/K52145254 +- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/ +author: Shannon Davis, Splunk +search: '`f5_bigip_rogue` +| regex _raw="(hsqldb;|.*\\.\\.;.*)" +| search `detect_F5_TMUI_RCE_CVE_2020_5902_filter`' +known_false_positives: unknown +tags: + analytics_story: + - F5 TMUI RCE CVE-2020-5902 + mitre_attack_id: + - T1190 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + - CIS 11 + nist: + - DE.CM + security_domain: network + asset_type: Network diff --git a/detections/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/detect_windows_dns_sigred_via_splunk_stream.yml new file mode 100644 index 0000000000..307781a124 --- /dev/null +++ b/detections/detect_windows_dns_sigred_via_splunk_stream.yml @@ -0,0 +1,35 @@ +name: Detect Windows DNS SIGRed via Splunk Stream +id: babd8d10-d073-11ea-87d0-0242ac130003 +version: 1 +date: '2020-07-28' +description: This search detects SIGRed via Splunk Stream. +how_to_implement: You must be ingesting Splunk Stream DNS and Splunk Stream TCP. + We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB + in size via stream:tcp. Replace the macro definitions ('stream:dns' and 'stream:tcp') + with configurations for your Splunk environment. +type: ESCU +references: +- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/ +author: Shannon Davis, Splunk +search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY) | spath protocol_stack | search protocol_stack="ip:tcp:dns" +| append + [search `stream_tcp` bytes_out>65000] +| `detect_windows_dns_sigred_via_splunk_stream_filter` +| stats count by flow_id +| where count>1 +| fields - count' +known_false_positives: unknown +tags: + analytics_story: + - Windows DNS SIGRed CVE-2020-1350 + mitre_attack_id: + - T1203 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + - CIS 12 + nist: + - DE.CM + security_domain: network + asset_type: Endpoint diff --git a/detections/detect_windows_dns_sigred_via_zeek.yml b/detections/detect_windows_dns_sigred_via_zeek.yml new file mode 100644 index 0000000000..97399f5568 --- /dev/null +++ b/detections/detect_windows_dns_sigred_via_zeek.yml @@ -0,0 +1,36 @@ +name: Detect Windows DNS SIGRed via Zeek +id: c5c622e4-d073-11ea-87d0-0242ac130003 +version: 1 +date: '2020-07-28' +description: This search detects SIGRed via Zeek DNS and Zeek Conn data. +how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. + Zeek data should also be getting ingested in JSON format. We are detecting + SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via + bro:conn:json. The Network Resolution and Network Traffic datamodels are in use + for this search. +type: ESCU +references: +- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/ +author: Shannon Davis, Splunk +search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id +| rename DNS.flow_id as flow_id +| append [| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.bytes_in>65000 by All_Traffic.flow_id | rename All_Traffic.flow_id as flow_id] +| `detect_windows_dns_sigred_via_zeek_filter` +| stats count by flow_id +| where count>1 +| fields - count ' +known_false_positives: unknown +tags: + analytics_story: + - Windows DNS SIGRed CVE-2020-1350 + mitre_attack_id: + - T1203 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + - CIS 16 + nist: + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/macros/detect_f5_tmui_rce_cve_2020_5902_filter.yml b/macros/detect_f5_tmui_rce_cve_2020_5902_filter.yml new file mode 100644 index 0000000000..caed65bae0 --- /dev/null +++ b/macros/detect_f5_tmui_rce_cve_2020_5902_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: kubernetes_azure_scan_fingerprint_filter diff --git a/macros/detect_windows_dns_sigred_via_splunk_stream_filter.yml b/macros/detect_windows_dns_sigred_via_splunk_stream_filter.yml new file mode 100644 index 0000000000..caed65bae0 --- /dev/null +++ b/macros/detect_windows_dns_sigred_via_splunk_stream_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: kubernetes_azure_scan_fingerprint_filter diff --git a/macros/detect_windows_dns_sigred_via_zeek_filter.yml b/macros/detect_windows_dns_sigred_via_zeek_filter.yml new file mode 100644 index 0000000000..caed65bae0 --- /dev/null +++ b/macros/detect_windows_dns_sigred_via_zeek_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: kubernetes_azure_scan_fingerprint_filter diff --git a/macros/f5_bigip_rogue.yml b/macros/f5_bigip_rogue.yml new file mode 100644 index 0000000000..1132a5ee1a --- /dev/null +++ b/macros/f5_bigip_rogue.yml @@ -0,0 +1,4 @@ +definition: index=netops sourcetype="f5:bigip:rogue" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: f5_bigip_rogue diff --git a/macros/stream_dns.yml b/macros/stream_dns.yml new file mode 100644 index 0000000000..211596a350 --- /dev/null +++ b/macros/stream_dns.yml @@ -0,0 +1,4 @@ +definition: sourcetype=stream:dns +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: stream_dns diff --git a/macros/stream_tcp.yml b/macros/stream_tcp.yml new file mode 100644 index 0000000000..3f02b04615 --- /dev/null +++ b/macros/stream_tcp.yml @@ -0,0 +1,4 @@ +definition: sourcetype=stream:tcp +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: stream_tcp diff --git a/stories/f5_tmui_rce_cve_2020_5902.yml b/stories/f5_tmui_rce_cve_2020_5902.yml new file mode 100644 index 0000000000..8e087f45d4 --- /dev/null +++ b/stories/f5_tmui_rce_cve_2020_5902.yml @@ -0,0 +1,27 @@ +name: F5 TMUI RCE CVE-2020-5902 +id: 7678c968-d46e-11ea-87d0-0242ac130003 +version: 1 +date: '2020-08-02' +description: Uncover activity consistent with CVE-2020-5902. + Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. + and Traffix SDC devices (vulnerable versions in F5 support link below). + This vulnerability allows unauthenticated users, along with authenticated users, who have access + to the configuration utility to execute system commands, create/delete files, disable services, + and/or execute Java code. This vulnerability can result in full system compromise. +narrative: 'A client is able to perform a remote code execution on an exposed and vulnerable system. + The detection search in this Analytic Story uses syslog to detect the malicious behavior. + Syslog is going to be the best detection method, as any systems using SSL to protect their management + console will make detection via wire data difficult. The searches included used Splunk Connect For + Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define + the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/)' +author: Shannon Davis, Splunk +type: ESCU +references: +- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/ +- https://support.f5.com/csp/article/K52145254 +- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/ +tags: + analytics_story: F5 TMUI RCE CVE-2020-5902 + usecase: Advanced Threat Detection + category: + - Adversary Tactics diff --git a/stories/windows_dns_cve_2020_1350.yml b/stories/windows_dns_cve_2020_1350.yml new file mode 100644 index 0000000000..d0c79b5812 --- /dev/null +++ b/stories/windows_dns_cve_2020_1350.yml @@ -0,0 +1,33 @@ +name: Windows DNS SIGRed CVE-2020-1350 +id: 36dbb206-d073-11ea-87d0-0242ac130003 +version: 1 +date: '2020-07-28' +description: Uncover activity consistent with CVE-2020-1350, or SIGRed. + Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 + to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). + An attacker can use the malicious payload to cause a buffer overflow on the vulnerable + system, leading to compromise. The included searches in this Analytic Story + are designed to identify the large response payload for SIG and KEY DNS records which can + be used for the exploit. +narrative: 'When a client requests a DNS record for a particular domain, that request + gets routed first through the client''s locally configured DNS server, then to any DNS server(s) + configured as forwarders, and then onto the target domain''s own DNS server(s). If a + attacker wanted to, they could host a malicious DNS server that responds to the initial + request with a specially crafted large response (~65KB). This response would flow through + to the client''s local DNS server, which if not patched for CVE-2020-1350, would cause the buffer + overflow. + The detection searches in this Analytic Story use wire data to detect the malicious behavior. + Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates + across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json + and bro:conn:json. These correlations are required to pick up both the DNS record types + (SIG and KEY) along with the payload size (>65KB).' +author: Shannon Davis, Splunk +type: ESCU +references: +- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/ +- https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability +tags: + analytics_story: Windows DNS SIGRed CVE-2020-1350 + usecase: Advanced Threat Detection + category: + - Adversary Tactics