diff --git a/detections/detect_zerologon_cve_2020_1472.yml b/detections/detect_zerologon_cve_2020_1472.yml new file mode 100644 index 0000000000..5da5735ffe --- /dev/null +++ b/detections/detect_zerologon_cve_2020_1472.yml @@ -0,0 +1,38 @@ +name: Detect Zerologon CVE-2020-1472 +id: bf7a06ec-f703-11ea-adc1-0242ac120002 +version: 1 +date: '2020-09-15' +description: This search detects Zerologon attempts via Zeek DCE-RPC data. +how_to_implement: You must be ingesting Zeek DCE-RPC data into Splunk. + Zeek data should also be getting ingested in JSON format. We are detecting + when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app + via bro:rpc:json. These three operations are then correlated on the Zeek UID field. +description: This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC +type: ESCU +references: +- https://www.secura.com/blog/zero-logon +- https://github.com/SecuraBV/CVE-2020-1472 +- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 +author: Shannon Davis, Splunk +search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) +| bin span=5m _time +| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge +count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount +count as totalcount by _time,src_ip,dest_ip +| search opscount=3 authcount>4 passcount>0 +| search `detect_zerologon_cve_2020_1472_filter`' +known_false_positives: unknown +tags: + analytics_story: + - Zerologon CVE-2020-1472 + mitre_attack_id: + - T1190 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + - CIS 11 + nist: + - DE.CM + security_domain: network + asset_type: Network diff --git a/macros/detect_zerologon_cve_2020_1472_filter.yml b/macros/detect_zerologon_cve_2020_1472_filter.yml new file mode 100644 index 0000000000..e5fb044dd1 --- /dev/null +++ b/macros/detect_zerologon_cve_2020_1472_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: detect_zerologon_cve_2020_1472_filter diff --git a/macros/zeek_rpc.yml b/macros/zeek_rpc.yml new file mode 100644 index 0000000000..14e7c7adcc --- /dev/null +++ b/macros/zeek_rpc.yml @@ -0,0 +1,4 @@ +definition: index=zeek sourcetype="zeek:rpc:json" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: zeek_rpc diff --git a/stories/zerologon_cve_2020_1472.yml b/stories/zerologon_cve_2020_1472.yml new file mode 100644 index 0000000000..08ce2b00be --- /dev/null +++ b/stories/zerologon_cve_2020_1472.yml @@ -0,0 +1,24 @@ +name: Zerologon CVE-2020-1472 +id: 8ba8a162-f702-11ea-adc1-0242ac120002 +version: 1 +date: '2020-09-15' +description: Uncover activity consistent with CVE-2020-1472. + Discovered by Tom Toovert of Secura, this vulnerability is due to a flaw in the cryptographic + authentication scheme used by the Netlogon Remote Protocol. + If successfully exploited, an attacker can use this vulnerability to impersonate any affected computer + to run remote procedure calls on its behalf. +narrative: 'An elevation of privilege vulnerability exists when an attacker establishes a vulnerable +Netlogon secure channel connection to a computer, using the Netlogon Remote Protocol (MS-NRPC). +An attacker who successfully exploits the vulnerability could run a specially crafted application +on a device on the network.' +author: Shannon Davis, Splunk +type: ESCU +references: +- https://www.secura.com/blog/zero-logon +- https://github.com/SecuraBV/CVE-2020-1472 +- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 +tags: + analytics_story: Zerologon CVE-2020-1472 + usecase: Advanced Threat Detection + category: + - Adversary Tactics