From 39f5939bc937f792c1d879f134094ba7d1219deb Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 18 Sep 2020 17:16:25 -0400 Subject: [PATCH 1/4] zero logon skeleton --- ...redential_dumping_through_lsass_access.yml | 1 + .../detect_mimikatz_using_loaded_images.yml | 1 + detections/detect_zerologon_via_zeek.yml | 38 +++++++++++++++++++ stories/detect_zerologon_attack.yml | 29 ++++++++++++++ 4 files changed, 69 insertions(+) create mode 100644 detections/detect_zerologon_via_zeek.yml create mode 100644 stories/detect_zerologon_attack.yml diff --git a/detections/detect_credential_dumping_through_lsass_access.yml b/detections/detect_credential_dumping_through_lsass_access.yml index 3df17ce650..95b2585e9c 100644 --- a/detections/detect_credential_dumping_through_lsass_access.yml +++ b/detections/detect_credential_dumping_through_lsass_access.yml @@ -25,6 +25,7 @@ known_false_positives: The activity may be legitimate. Other tools can access ls tags: analytics_story: - Credential Dumping + - Detect Zerologon Attack mitre_attack_id: - T1003.001 kill_chain_phases: diff --git a/detections/detect_mimikatz_using_loaded_images.yml b/detections/detect_mimikatz_using_loaded_images.yml index 7f5fb1b8ae..ed28cccce1 100644 --- a/detections/detect_mimikatz_using_loaded_images.yml +++ b/detections/detect_mimikatz_using_loaded_images.yml @@ -24,6 +24,7 @@ known_false_positives: Other tools can import the same DLLs. These tools should tags: analytics_story: - Credential Dumping + - Detect Zerologon Attack mitre_attack_id: - T1003.001 kill_chain_phases: diff --git a/detections/detect_zerologon_via_zeek.yml b/detections/detect_zerologon_via_zeek.yml new file mode 100644 index 0000000000..8cc7f5e728 --- /dev/null +++ b/detections/detect_zerologon_via_zeek.yml @@ -0,0 +1,38 @@ +name: Detect Zerologon via Zeek +id: bf7a06ec-f703-11ea-adc1-0242ac120002 +version: 1 +date: '2020-09-15' +description: This search detects Zerologon attempts via Zeek DCE-RPC data. +how_to_implement: You must be ingesting Zeek DCE-RPC data into Splunk. + Zeek data should also be getting ingested in JSON format. We are detecting + when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app + via bro:rpc:json. These three operations are then correlated on the Zeek UID field. +description: This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC +type: ESCU +references: +- https://www.secura.com/blog/zero-logon +- https://github.com/SecuraBV/CVE-2020-1472 +- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 +author: Shannon Davis, Splunk +search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) +| bin span=5m _time +| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge +count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount +count as totalcount by _time,src_ip,dest_ip +| search opscount=3 authcount>4 passcount>0 +| search `detect_zerologon_via_zeek_filter`' +known_false_positives: unknown +tags: + analytics_story: + - Detect Zerologon Attack + mitre_attack_id: + - T1190 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + - CIS 11 + nist: + - DE.CM + security_domain: network + asset_type: Network diff --git a/stories/detect_zerologon_attack.yml b/stories/detect_zerologon_attack.yml new file mode 100644 index 0000000000..120e0f6ecd --- /dev/null +++ b/stories/detect_zerologon_attack.yml @@ -0,0 +1,29 @@ +name: Detect Zerologon Attack +id: 5d14a962-569e-4578-939f-f386feb63ce4 +version: 1 +date: '2020-09-18' +description: Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein + attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack + is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story + are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz + as payload carrier. +narrative: This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, + using Netlogon Remote Protocol (MS-NRPC). + This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually + reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and + assign themselve high privileges that can lead to domain controller and potentially complete network takeover. + The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these + searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz + tool which has bee updated to carry this attack payload. +author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk +type: ESCU +references: +- https://attack.mitre.org/wiki/Technique/T1003 +- https://github.com/SecuraBV/CVE-2020-1472 +- https://www.secura.com/blog/zero-logon +- https://nvd.nist.gov/vuln/detail/CVE-2020-1472 +tags: + analytics_story: Detect Zerologon Attack + usecase: Advanced Threat Detection + category: + - Adversary Tactics From b78035c976d184ca05efa39e203c19653435ba68 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 18 Sep 2020 17:36:46 -0400 Subject: [PATCH 2/4] adding macros --- macros/detect_zerologon_via_zeek_filter.yml | 4 ++++ macros/zeek_rpc.yml | 4 ++++ 2 files changed, 8 insertions(+) create mode 100644 macros/detect_zerologon_via_zeek_filter.yml create mode 100644 macros/zeek_rpc.yml diff --git a/macros/detect_zerologon_via_zeek_filter.yml b/macros/detect_zerologon_via_zeek_filter.yml new file mode 100644 index 0000000000..021ff1c691 --- /dev/null +++ b/macros/detect_zerologon_via_zeek_filter.yml @@ -0,0 +1,4 @@ +definition: search * +description: Use this macro to add additional filters +name: detect_zerologon_via_zeek_filter + diff --git a/macros/zeek_rpc.yml b/macros/zeek_rpc.yml new file mode 100644 index 0000000000..14e7c7adcc --- /dev/null +++ b/macros/zeek_rpc.yml @@ -0,0 +1,4 @@ +definition: index=zeek sourcetype="zeek:rpc:json" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: zeek_rpc From 660135b77a4ddfe666bc06cbbabe012e018d2bc5 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 18 Sep 2020 18:39:50 -0400 Subject: [PATCH 3/4] adding 4742 detection --- ...omputer_changed_with_anonymous_account.yml | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 detections/detect_computer_changed_with_anonymous_account.yml diff --git a/detections/detect_computer_changed_with_anonymous_account.yml b/detections/detect_computer_changed_with_anonymous_account.yml new file mode 100644 index 0000000000..0bcab5ef91 --- /dev/null +++ b/detections/detect_computer_changed_with_anonymous_account.yml @@ -0,0 +1,33 @@ +name: Detect Computer Changed with Anonymous Account +id: 1400624a-d42d-484d-8843-e6753e6e3645 +version: 1 +date: '2020-09-18' +description: This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account. +how_to_implement: This search requires audit computer account management to be enabled on the system in order to generate Event ID 4742. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Windows Event Logs. Replace the macro definition + with configurations for your Splunk environment. The search also uses a post-filter + macro designed to filter out known false positives. +type: ESCU +references: +- https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/ +author: Rod Soto, Jose Hernandez, Splunk +search: '`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3 +| stats count values(host) as host, values(TargetDomainName) as Domain, values(user) as user +| `detect_computer_changed_with_anonymous_account_filter`' +known_false_positives: None thus far found +tags: + analytics_story: + - Detect Zerologon Attack + mitre_attack_id: + - T1210 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 6 + - CIS 8 + nist: + - DE.AE + - DE.CM + security_domain: endpoint + asset_type: Windows From 4f8b5cd6a962ab82a0c70ecea77b7baa9363468d Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 18 Sep 2020 19:16:28 -0400 Subject: [PATCH 4/4] fixed some issues with panels that are empty failing generate --- bin/generate.py | 3 +-- bin/jinja2_templates/es_investigations.j2 | 5 +++++ stories/detect_zerologon_attack.yml | 10 +++++----- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 94dc55a36e..d8d25d4de0 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -300,7 +300,6 @@ def generate_workbench_panels(response_tasks, stories): output = template.render(response_tasks=workbench_panel_objects, stories=stories) with open(output_path, 'w') as f: f.write(output) - j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True) template = j2_env.get_template('workflow_actions.j2') @@ -402,7 +401,7 @@ def map_response_tasks_to_stories(response_tasks): for story in response_task['tags']['analytics_story']: if 'type' in response_task.keys(): task_name = str(response_task['type'] + ' - ' + response_task['name']) - else: + else: task_name = str('ESCU - ' + response_task['name']) if not (story in sto_res): sto_res[story] = {task_name} diff --git a/bin/jinja2_templates/es_investigations.j2 b/bin/jinja2_templates/es_investigations.j2 index 865efd48ec..bf5a2dd8e2 100644 --- a/bin/jinja2_templates/es_investigations.j2 +++ b/bin/jinja2_templates/es_investigations.j2 @@ -4,7 +4,12 @@ label = {{ story.name }} description = {{ story.description }} disabled = 0 + +{% if story.workbench_panels is defined %} panels = {{ story.workbench_panels | tojson }} +{% else %} +panels = +{% endif %} {% endfor %} diff --git a/stories/detect_zerologon_attack.yml b/stories/detect_zerologon_attack.yml index 120e0f6ecd..0871671b75 100644 --- a/stories/detect_zerologon_attack.yml +++ b/stories/detect_zerologon_attack.yml @@ -2,20 +2,20 @@ name: Detect Zerologon Attack id: 5d14a962-569e-4578-939f-f386feb63ce4 version: 1 date: '2020-09-18' -description: Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein +description: 'Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz - as payload carrier. -narrative: This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, + as payload carrier.' +narrative: 'This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz - tool which has bee updated to carry this attack payload. -author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk + tool which has bee updated to carry this attack payload.' +author: 'Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk' type: ESCU references: - https://attack.mitre.org/wiki/Technique/T1003