Windows DNS SIGRed CVE-2020-1350 and F5 TMUI RCE CVE-2020-5902

detections/detect_f5_tmui_rct_cve_2020_5902.yml

@@ -0,0 +1,35 @@
+name: Detect F5 TMUI RCE CVE_2020_5902
+id: 810e4dbc-d46e-11ea-87d0-0242ac130003
+version: 1
+date: '2020-08-02'
+description: This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices
+how_to_implement: To consistently detect exploit attempts on F5 devices using the vulnerabilities
+contained within CVE-2020-5902 it is recommended to ingest logs via syslog.  As many BIG-IP devices will
+have SSL enabled on their management interfaces, detections via wire data may not pick anything up unless
+you are decrypting SSL traffic in order to inspect it.  I am using a regex string from a Cloudflare
+mitigation technique to try and always catch the offending string (..;), along with the other exploit of using
+(hsqldb;).
+type: ESCU
+references:
+- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
+- https://support.f5.com/csp/article/K52145254
+- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
+author: Shannon Davis, Splunk
+search: '`f5_bigip_rogue`
+| regex _raw="(hsqldb;|.*\\.\\.;.*)"
+| search `detect_F5_TMUI_RCE_CVE_2020_5902_filter`'
+known_false_positives: unknown
+tags:
+  analytics_story:
+  - F5 TMUI RCE CVE-2020-5902
+  mitre_attack_id:
+  - T1190
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  - CIS 11
+  nist:
+  - DE.CM
+  security_domain: network
+  asset_type: Network

detections/detect_windows_dns_sigred_via_splunk_stream.yml

@@ -0,0 +1,35 @@
+name: Detect Windows DNS SIGRed via Splunk Stream
+id: babd8d10-d073-11ea-87d0-0242ac130003
+version: 1
+date: '2020-07-28'
+description: This search detects SIGRed via Splunk Stream.
+how_to_implement: You must be ingesting Splunk Stream DNS and Splunk Stream TCP.
+  We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB
+  in size via stream:tcp.  Replace the macro definitions ('stream:dns' and 'stream:tcp')
+  with configurations for your Splunk environment.
+type: ESCU
+references:
+- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+author: Shannon Davis, Splunk
+search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY) | spath protocol_stack | search protocol_stack="ip:tcp:dns"
+| append
+    [search `stream_tcp` bytes_out>65000]
+| `detect_windows_dns_sigred_via_splunk_stream_filter`
+| stats count by flow_id
+| where count>1
+| fields - count'
+known_false_positives: unknown
+tags:
+  analytics_story:
+  - Windows DNS SIGRed CVE-2020-1350
+  mitre_attack_id:
+  - T1203
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  - CIS 12
+  nist:
+  - DE.CM
+  security_domain: network
+  asset_type: Endpoint

detections/detect_windows_dns_sigred_via_zeek.yml

@@ -0,0 +1,36 @@
+name: Detect Windows DNS SIGRed via Zeek
+id: c5c622e4-d073-11ea-87d0-0242ac130003
+version: 1
+date: '2020-07-28'
+description: This search detects SIGRed via Zeek DNS and Zeek Conn data.
+how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk.
+  Zeek data should also be getting ingested in JSON format.  We are detecting
+  SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via
+  bro:conn:json.  The Network Resolution and Network Traffic datamodels are in use
+  for this search.
+type: ESCU
+references:
+- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+author: Shannon Davis, Splunk
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id
+| rename DNS.flow_id as flow_id
+| append [| tstats  `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.bytes_in>65000 by All_Traffic.flow_id | rename All_Traffic.flow_id as flow_id]
+| `detect_windows_dns_sigred_via_zeek_filter`
+| stats count by flow_id
+| where count>1
+| fields - count '
+known_false_positives: unknown
+tags:
+  analytics_story:
+  - Windows DNS SIGRed CVE-2020-1350
+  mitre_attack_id:
+  - T1203
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint

macros/detect_f5_tmui_rce_cve_2020_5902_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_scan_fingerprint_filter

macros/detect_windows_dns_sigred_via_splunk_stream_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_scan_fingerprint_filter

macros/detect_windows_dns_sigred_via_zeek_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_scan_fingerprint_filter

macros/f5_bigip_rogue.yml

@@ -0,0 +1,4 @@
+definition: index=netops sourcetype="f5:bigip:rogue"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: f5_bigip_rogue

macros/stream_dns.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=stream:dns
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: stream_dns

macros/stream_tcp.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=stream:tcp
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: stream_tcp

stories/f5_tmui_rce_cve_2020_5902.yml

@@ -0,0 +1,27 @@
+name: F5 TMUI RCE CVE-2020-5902
+id: 7678c968-d46e-11ea-87d0-0242ac130003
+version: 1
+date: '2020-08-02'
+description: Uncover activity consistent with CVE-2020-5902.
+  Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ.
+  and Traffix SDC devices (vulnerable versions in F5 support link below).
+  This vulnerability allows unauthenticated users, along with authenticated users, who have access
+  to the configuration utility to execute system commands, create/delete files, disable services,
+  and/or execute Java code.  This vulnerability can result in full system compromise.
+narrative: 'A client is able to perform a remote code execution on an exposed and vulnerable system.
+  The detection search in this Analytic Story uses syslog to detect the malicious behavior.
+  Syslog is going to be the best detection method, as any systems using SSL to protect their management
+  console will make detection via wire data difficult.  The searches included used Splunk Connect For
+  Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define
+  the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/)'
+author: Shannon Davis, Splunk
+type: ESCU
+references:
+- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
+- https://support.f5.com/csp/article/K52145254
+- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
+tags:
+  analytics_story: F5 TMUI RCE CVE-2020-5902
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics

stories/windows_dns_cve_2020_1350.yml

@@ -0,0 +1,33 @@
+name: Windows DNS SIGRed CVE-2020-1350
+id: 36dbb206-d073-11ea-87d0-0242ac130003
+version: 1
+date: '2020-07-28'
+description: Uncover activity consistent with CVE-2020-1350, or SIGRed.
+  Discovered by Checkpoint researchers, this vulnerability affects Windows 2003
+  to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP).
+  An attacker can use the malicious payload to cause a buffer overflow on the vulnerable
+  system, leading to compromise.  The included searches in this Analytic Story
+  are designed to identify the large response payload for SIG and KEY DNS records which can
+  be used for the exploit.
+narrative: 'When a client requests a DNS record for a particular domain, that request
+  gets routed first through the client''s locally configured DNS server, then to any DNS server(s)
+  configured as forwarders, and then onto the target domain''s own DNS server(s).  If a
+  attacker wanted to, they could host a malicious DNS server that responds to the initial
+  request with a specially crafted large response (~65KB).  This response would flow through
+  to the client''s local DNS server, which if not patched for CVE-2020-1350, would cause the buffer
+  overflow.
+  The detection searches in this Analytic Story use wire data to detect the malicious behavior.
+  Searches for Splunk Stream and Zeek are included.  The Splunk Stream search correlates
+  across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json
+  and bro:conn:json.  These correlations are required to pick up both the DNS record types
+  (SIG and KEY) along with the payload size (>65KB).'
+author: Shannon Davis, Splunk
+type: ESCU
+references:
+- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+- https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability
+tags:
+  analytics_story: Windows DNS SIGRed CVE-2020-1350
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics