Zerologon CVE-2020-1472

detections/detect_zerologon_cve_2020_1472.yml

@@ -0,0 +1,38 @@
+name: Detect Zerologon CVE-2020-1472
+id: bf7a06ec-f703-11ea-adc1-0242ac120002
+version: 1
+date: '2020-09-15'
+description: This search detects Zerologon attempts via Zeek DCE-RPC data.
+how_to_implement: You must be ingesting Zeek DCE-RPC data into Splunk.
+  Zeek data should also be getting ingested in JSON format.  We are detecting
+  when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app
+  via bro:rpc:json.  These three operations are then correlated on the Zeek UID field.
+description: This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC
+type: ESCU
+references:
+- https://www.secura.com/blog/zero-logon
+- https://github.com/SecuraBV/CVE-2020-1472
+- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
+author: Shannon Davis, Splunk
+search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3)
+| bin span=5m _time
+| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge
+count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount
+count as totalcount by _time,src_ip,dest_ip
+| search opscount=3 authcount>4 passcount>0
+| search `detect_zerologon_cve_2020_1472_filter`'
+known_false_positives: unknown
+tags:
+  analytics_story:
+  - Zerologon CVE-2020-1472
+  mitre_attack_id:
+  - T1190
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  - CIS 11
+  nist:
+  - DE.CM
+  security_domain: network
+  asset_type: Network

macros/detect_zerologon_cve_2020_1472_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: detect_zerologon_cve_2020_1472_filter

macros/zeek_rpc.yml

@@ -0,0 +1,4 @@
+definition: index=zeek sourcetype="zeek:rpc:json"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: zeek_rpc

stories/zerologon_cve_2020_1472.yml

@@ -0,0 +1,24 @@
+name: Zerologon CVE-2020-1472
+id: 8ba8a162-f702-11ea-adc1-0242ac120002
+version: 1
+date: '2020-09-15'
+description: Uncover activity consistent with CVE-2020-1472.
+  Discovered by Tom Toovert of Secura, this vulnerability is due to a flaw in the cryptographic
+  authentication scheme used by the Netlogon Remote Protocol.
+  If successfully exploited, an attacker can use this vulnerability to impersonate any affected computer
+  to run remote procedure calls on its behalf.
+narrative: 'An elevation of privilege vulnerability exists when an attacker establishes a vulnerable
+Netlogon secure channel connection to a computer, using the Netlogon Remote Protocol (MS-NRPC).
+An attacker who successfully exploits the vulnerability could run a specially crafted application
+on a device on the network.'
+author: Shannon Davis, Splunk
+type: ESCU
+references:
+- https://www.secura.com/blog/zero-logon
+- https://github.com/SecuraBV/CVE-2020-1472
+- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
+tags:
+  analytics_story: Zerologon CVE-2020-1472
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics