From fc567c124ac8dd4c8931e2c8632c616e9146ca02 Mon Sep 17 00:00:00 2001 From: Shannon Davis Date: Tue, 15 Sep 2020 13:49:43 +1000 Subject: [PATCH 1/2] Zerologon CVE-2020-1472 Story, Zeek Detection, and macros for Zerologon CVE-2020-1472. --- .../detect_zero_logon_cve_2020_1472.yml | 35 +++++++++++++++++++ ...detect_zero_logon_cve_2020_1472_filter.yml | 3 ++ macros/zeek_rpc.yml | 4 +++ stories/zero_logon_cve_2020_1472.yml | 24 +++++++++++++ 4 files changed, 66 insertions(+) create mode 100644 detections/detect_zero_logon_cve_2020_1472.yml create mode 100644 macros/detect_zero_logon_cve_2020_1472_filter.yml create mode 100644 macros/zeek_rpc.yml create mode 100644 stories/zero_logon_cve_2020_1472.yml diff --git a/detections/detect_zero_logon_cve_2020_1472.yml b/detections/detect_zero_logon_cve_2020_1472.yml new file mode 100644 index 0000000000..07107dbc07 --- /dev/null +++ b/detections/detect_zero_logon_cve_2020_1472.yml @@ -0,0 +1,35 @@ +name: Detect Zerologon CVE-2020-1472 +id: bf7a06ec-f703-11ea-adc1-0242ac120002 +version: 1 +date: '2020-09-15' +description: This search detects Zerologon attempts via Zeek DCE-RPC data. +how_to_implement: You must be ingesting Zeek DCE-RPC data into Splunk. + Zeek data should also be getting ingested in JSON format. We are detecting + when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app + via bro:rpc:json. These three operations are then correlated on the Zeek UID field. +description: This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC +type: ESCU +references: +- https://www.secura.com/blog/zero-logon +- https://github.com/SecuraBV/CVE-2020-1472 +- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 +author: Shannon Davis, Splunk +search: '`zeek_rpc` operation IN (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) +| stats count by uid +| search count=3 +| search `detect_zero_logon_cve_2020_1472_filter`' +known_false_positives: unknown +tags: + analytics_story: + - Zerologon CVE-2020-1472 + mitre_attack_id: + - T1190 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + - CIS 11 + nist: + - DE.CM + security_domain: network + asset_type: Network diff --git a/macros/detect_zero_logon_cve_2020_1472_filter.yml b/macros/detect_zero_logon_cve_2020_1472_filter.yml new file mode 100644 index 0000000000..71ff387ba7 --- /dev/null +++ b/macros/detect_zero_logon_cve_2020_1472_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: detect_zero_logon_cve_2020_1472_filter diff --git a/macros/zeek_rpc.yml b/macros/zeek_rpc.yml new file mode 100644 index 0000000000..14e7c7adcc --- /dev/null +++ b/macros/zeek_rpc.yml @@ -0,0 +1,4 @@ +definition: index=zeek sourcetype="zeek:rpc:json" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: zeek_rpc diff --git a/stories/zero_logon_cve_2020_1472.yml b/stories/zero_logon_cve_2020_1472.yml new file mode 100644 index 0000000000..08ce2b00be --- /dev/null +++ b/stories/zero_logon_cve_2020_1472.yml @@ -0,0 +1,24 @@ +name: Zerologon CVE-2020-1472 +id: 8ba8a162-f702-11ea-adc1-0242ac120002 +version: 1 +date: '2020-09-15' +description: Uncover activity consistent with CVE-2020-1472. + Discovered by Tom Toovert of Secura, this vulnerability is due to a flaw in the cryptographic + authentication scheme used by the Netlogon Remote Protocol. + If successfully exploited, an attacker can use this vulnerability to impersonate any affected computer + to run remote procedure calls on its behalf. +narrative: 'An elevation of privilege vulnerability exists when an attacker establishes a vulnerable +Netlogon secure channel connection to a computer, using the Netlogon Remote Protocol (MS-NRPC). +An attacker who successfully exploits the vulnerability could run a specially crafted application +on a device on the network.' +author: Shannon Davis, Splunk +type: ESCU +references: +- https://www.secura.com/blog/zero-logon +- https://github.com/SecuraBV/CVE-2020-1472 +- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 +tags: + analytics_story: Zerologon CVE-2020-1472 + usecase: Advanced Threat Detection + category: + - Adversary Tactics From 12a7ba616094783add59d54554c1f72e8b97cd2e Mon Sep 17 00:00:00 2001 From: Shannon Davis Date: Thu, 17 Sep 2020 08:04:58 +1000 Subject: [PATCH 2/2] Zerologon Updates Updated filenames so validate.py passes, and modified detection code to help reduce false positives. Thanks to @guard-it. --- ...20_1472.yml => detect_zerologon_cve_2020_1472.yml} | 11 +++++++---- ....yml => detect_zerologon_cve_2020_1472_filter.yml} | 2 +- ..._cve_2020_1472.yml => zerologon_cve_2020_1472.yml} | 0 3 files changed, 8 insertions(+), 5 deletions(-) rename detections/{detect_zero_logon_cve_2020_1472.yml => detect_zerologon_cve_2020_1472.yml} (69%) rename macros/{detect_zero_logon_cve_2020_1472_filter.yml => detect_zerologon_cve_2020_1472_filter.yml} (62%) rename stories/{zero_logon_cve_2020_1472.yml => zerologon_cve_2020_1472.yml} (100%) diff --git a/detections/detect_zero_logon_cve_2020_1472.yml b/detections/detect_zerologon_cve_2020_1472.yml similarity index 69% rename from detections/detect_zero_logon_cve_2020_1472.yml rename to detections/detect_zerologon_cve_2020_1472.yml index 07107dbc07..5da5735ffe 100644 --- a/detections/detect_zero_logon_cve_2020_1472.yml +++ b/detections/detect_zerologon_cve_2020_1472.yml @@ -14,10 +14,13 @@ references: - https://github.com/SecuraBV/CVE-2020-1472 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 author: Shannon Davis, Splunk -search: '`zeek_rpc` operation IN (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) -| stats count by uid -| search count=3 -| search `detect_zero_logon_cve_2020_1472_filter`' +search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) +| bin span=5m _time +| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge +count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount +count as totalcount by _time,src_ip,dest_ip +| search opscount=3 authcount>4 passcount>0 +| search `detect_zerologon_cve_2020_1472_filter`' known_false_positives: unknown tags: analytics_story: diff --git a/macros/detect_zero_logon_cve_2020_1472_filter.yml b/macros/detect_zerologon_cve_2020_1472_filter.yml similarity index 62% rename from macros/detect_zero_logon_cve_2020_1472_filter.yml rename to macros/detect_zerologon_cve_2020_1472_filter.yml index 71ff387ba7..e5fb044dd1 100644 --- a/macros/detect_zero_logon_cve_2020_1472_filter.yml +++ b/macros/detect_zerologon_cve_2020_1472_filter.yml @@ -1,3 +1,3 @@ definition: search * description: Use this macro to add additional filters -name: detect_zero_logon_cve_2020_1472_filter +name: detect_zerologon_cve_2020_1472_filter diff --git a/stories/zero_logon_cve_2020_1472.yml b/stories/zerologon_cve_2020_1472.yml similarity index 100% rename from stories/zero_logon_cve_2020_1472.yml rename to stories/zerologon_cve_2020_1472.yml