Skip to content

Commit d8745b3

Browse files
srv-rr-gh-researchbtsrv-rr-gh-researchbt
authored
Branch was auto-updated.
2 parents 097e392 + 874a059 commit d8745b3

File tree

400 files changed

+5878
-1106
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

400 files changed

+5878
-1106
lines changed

‎contentctl

‎contentctl.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ build:
55
name: DA-ESS-ContentUpdate
66
path_root: dist
77
prefix: ESCU
8-
build: 004161
9-
version: 4.16.1
8+
build: 004170
9+
version: 4.17.0
1010
label: ES Content Updates
1111
author_name: Splunk Threat Research Team
1212
author_email: [email protected]
@@ -22,4 +22,4 @@ build_api:
2222
enrichments:
2323
attack_enrichment: true
2424
cve_enrichment: true
25-
splunk_app_enrichment: false
25+
splunk_app_enrichment: false

‎detections/cloud/aws_iam_failure_group_deletion.yml

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: AWS IAM Failure Group Deletion
22
id: 723b861a-92eb-11eb-93b8-acde48001122
3-
version: 1
4-
date: '2021-04-01'
3+
version: 2
4+
date: '2023-11-07'
55
author: Michael Haag, Splunk
66
status: production
77
type: Anomaly
@@ -32,8 +32,7 @@ tags:
3232
asset_type: AWS Account
3333
confidence: 50
3434
impact: 10
35-
message: User $user_arn$ has had mulitple failures while attempting to delete groups
36-
from $src$
35+
message: User $user_arn$ has had mulitple failures while attempting to delete groups from $src$
3736
mitre_attack_id:
3837
- T1098
3938
observable:
@@ -45,10 +44,6 @@ tags:
4544
type: User
4645
role:
4746
- Victim
48-
- name: group_name
49-
type: User
50-
role:
51-
- Victim
5247
product:
5348
- Splunk Enterprise
5449
- Splunk Enterprise Security

‎detections/cloud/aws_s3_exfiltration_behavior_identified.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: AWS S3 Exfiltration Behavior Identified
22
id: 85096389-a443-42df-b89d-200efbb1b560
3-
version: 1
4-
date: '2023-05-04'
3+
version: 2
4+
date: '2023-11-07'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: Correlation
@@ -24,7 +24,7 @@ tags:
2424
asset_type: AWS Account
2525
confidence: 90
2626
impact: 90
27-
message: Multiple AWS Exfiltration detections $source$ and techniques $All_Risk.annotations.mitre_attack.mitre_tactic_id$ trigged for risk object $risk_object$
27+
message: Multiple AWS Exfiltration detections $source$ and techniques $annotations.mitre_attack.mitre_tactic_id$ trigged for risk object $risk_object$
2828
mitre_attack_id:
2929
- T1537
3030
observable:

‎detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: AWS Successful Console Authentication From Multiple IPs
22
id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb
3-
version: 1
4-
date: '2023-01-19'
3+
version: 2
4+
date: '2023-11-07'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -12,8 +12,8 @@ description: The following analytic identifies an AWS account successfully authe
1212
time as a legitimate user. As users may behave differently across organizations,
1313
security teams should test and customize this detection to fit their environments.
1414
data_source: []
15-
search: ' `cloudtrail` eventName = ConsoleLogin | bin span=5m _time | stats values(userAgent)
16-
values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn
15+
search: ' `cloudtrail` eventName = ConsoleLogin | bin span=5m _time | stats values(userAgent) as userAgent
16+
values(eventName) as eventName values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn
1717
| where distinct_ip_count>1 | `aws_successful_console_authentication_from_multiple_ips_filter`'
1818
how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
1919
search works when AWS CloudTrail events are normalized use the Authentication datamodel.
@@ -30,16 +30,16 @@ tags:
3030
confidence: 80
3131
impact: 90
3232
message: User $user_arn$ has successfully logged into the AWS Console from different
33-
IP addresses $src$ within 5 mins
33+
IP addresses $src_ip$ within 5 mins
3434
mitre_attack_id:
3535
- T1586
3636
- T1535
3737
observable:
38-
- name: src
38+
- name: src_ip
3939
type: IP Address
4040
role:
4141
- Attacker
42-
- name: user
42+
- name: user_arn
4343
type: User
4444
role:
4545
- Victim
@@ -49,12 +49,10 @@ tags:
4949
- Splunk Cloud
5050
required_fields:
5151
- _time
52-
- Authentication.src
53-
- Authentication.user
54-
- Authentication.signature
55-
- Authentication.user_agent
56-
- Authentication.action
57-
- Authentication.user_type
52+
- eventName
53+
- userAgent
54+
- src_ip
55+
- user_arn
5856
risk_score: 72
5957
security_domain: threat
6058
tests:

‎detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: AWS Unusual Number of Failed Authentications From Ip
22
id: 0b5c9c2b-e2cb-4831-b4f1-af125ceb1386
3-
version: 1
4-
date: '2022-09-26'
3+
version: 2
4+
date: '2023-11-07'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -19,10 +19,10 @@ description: The following analytic identifies one source IP failing to authenti
1919
Multiple Users Failing To Authenticate From Ip`.
2020
data_source: []
2121
search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time
22-
| stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time,
23-
src_ip | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as
24-
ip_std by _time | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts
25-
> 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
22+
| stats dc(_raw) AS distinct_attempts values(user_name) as tried_accounts by _time,
23+
src_ip | eventstats avg(distinct_attempts) as avg_attempts , stdev(distinct_attempts) as
24+
ip_std by _time | eval upperBound=(avg_attempts+ip_std*3) | eval isOutlier=if(distinct_attempts
25+
> 10 and distinct_attempts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
2626
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail.
2727
We recommend the users to try different combinations of the bucket span time and
2828
the calculation of the upperBound field to tune this search according to their environment

‎detections/cloud/azure_ad_pim_role_assigned.yml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Azure AD PIM Role Assigned
22
id: fcd6dfeb-191c-46a0-a29c-c306382145ab
3-
version: 1
4-
date: '2023-04-26'
3+
version: 2
4+
date: '2023-11-07'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,8 @@ description: The following analytic identifies the assignment of the Azure AD PI
1515
search: ' `azuread` operationName="Add eligible member to role in PIM completed*"
1616
| rename properties.* as *
1717
| rename targetResources{}.userPrincipalName as userPrincipalName
18-
| stats values(userPrincipalName) values(targetResources{}.displayName) by _time, result, operationName, initiatedBy.user.displayName
18+
| rename initiatedBy.user.userPrincipalName as initiatedBy
19+
| stats values(userPrincipalName) as userPrincipalName values(targetResources{}.displayName) as target_display_name by _time, result, operationName, initiatedBy
1920
| `azure_ad_pim_role_assigned_filter`'
2021
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
2122
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -33,12 +34,12 @@ tags:
3334
asset_type: Azure Active Directory
3435
confidence: 50
3536
impact: 70
36-
message: An Azure AD PIM role assignment was assiged to $userPrincipalName$
37+
message: An Azure AD PIM role assignment was assiged to $userPrincipalName$ by $initiatedBy$
3738
mitre_attack_id:
3839
- T1098
3940
- T1098.003
4041
observable:
41-
- name: userPrincipalName
42+
- name: initiatedBy
4243
type: User
4344
role:
4445
- Attacker

‎detections/cloud/azure_ad_pim_role_assignment_activated.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Azure AD PIM Role Assignment Activated
22
id: 952e80d0-e343-439b-83f4-808c3e6fbf2e
3-
version: 1
4-
date: '2023-04-26'
3+
version: 2
4+
date: '2023-11-07'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies the assignment of the Azure AD PI
1515
search: ' `azuread` operationName="Add member to role completed (PIM activation)"
1616
| rename properties.* as *
1717
| rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
18-
| stats values(userPrincipalName) values(targetResources{}.displayName) by _time, initiatedBy, result, operationName,
18+
| stats values(userPrincipalName) as userPrincipalName values(targetResources{}.displayName) as target_display_name by _time, initiatedBy, result, operationName,
1919
| `azure_ad_pim_role_assignment_activated_filter`'
2020
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
2121
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -38,7 +38,7 @@ tags:
3838
- T1098
3939
- T1098.003
4040
observable:
41-
- name: userPrincipalName
41+
- name: initiatedBy
4242
type: User
4343
role:
4444
- Attacker

‎detections/cloud/azure_automation_runbook_created.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Azure Automation Runbook Created
22
id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
3-
version: 1
4-
date: '2022-08-22'
3+
version: 2
4+
date: '2023-11-07'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -17,7 +17,7 @@ description: The following analytic identifies the creation of a new Azure Autom
1717
data_source: []
1818
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation
1919
Runbook" object!=AzureAutomationTutorial* status.value=Succeeded | dedup object
20-
| stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
20+
| stats values(object) as object by _time, caller, claims.ipaddr, resourceGroupName, object_path
2121
| `azure_automation_runbook_created_filter`'
2222
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
2323
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).

‎detections/cloud/azure_runbook_webhook_created.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Azure Runbook Webhook Created
22
id: e98944a9-92e4-443c-81b8-a322e33ce75a
3-
version: 1
4-
date: '2022-08-23'
3+
version: 2
4+
date: '2023-11-07'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -17,7 +17,7 @@ description: The following analytic identifies the creation of a new Automation
1717
on a VM. This provides a persistent foothold on the environment.
1818
data_source: []
1919
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation
20-
webhook" status.value=Succeeded | stats values(object) by _time, caller, claims.ipaddr,
20+
webhook" status.value=Succeeded | stats values(object) as object by _time, caller, claims.ipaddr,
2121
resourceGroupName, object_path | `azure_runbook_webhook_created_filter`'
2222
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
2323
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).

‎detections/cloud/high_number_of_login_failures_from_a_single_source.yml

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,31 @@
11
name: High Number of Login Failures from a single source
22
id: 7f398cfb-918d-41f4-8db8-2e2474e02222
3-
version: 1
3+
version: 2
44
date: '2020-12-16'
5-
author: Bhavin Patel, Splunk
6-
status: experimental
5+
author: Bhavin Patel, Mauricio Velazco, Splunk
6+
status: production
77
type: Anomaly
8-
description: This search will detect more than 5 login failures in Office365 Azure
9-
Active Directory from a single source IP address. Please adjust the threshold value
10-
of 5 as suited for your environment.
8+
description: This analytic detects multiple failed login attempts in Office365 Azure Active Directory from a single source IP address. Specifically, it identifies scenarios where there are more than 10 unsuccessful login attempts within a short time frame. The detection leverages Office365 management activity logs, specifically the AzureActiveDirectoryStsLogon records from the AzureActiveDirectory workload. It aggregates these logs in 5-minute intervals to count the number of failed login attempts and associates them with the originating source IP address. Multiple failed login attempts from a single source can be indicative of brute-force attacks, password spraying, or other malicious authentication attempts. Identifying and responding to these patterns promptly can prevent unauthorized access and potential breaches. If this detection represents a true positive, an attacker might be attempting to gain unauthorized access to an Office365 account. Successful compromise could lead to unauthorized access to sensitive data, potential lateral movement within the organization, or further malicious activities using the compromised account.
119
data_source: []
12-
search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon
13-
app=AzureActiveDirectory | stats count dc(user) as accounts_locked values(user)
14-
as user values(LogonError) as LogonError values(authentication_method) as authentication_method
15-
values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type
16-
Operation app | search accounts_locked >= 5| `high_number_of_login_failures_from_a_single_source_filter`'
17-
how_to_implement: ''
18-
known_false_positives: unknown
19-
references: []
10+
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon
11+
| bucket span=5m _time
12+
| stats dc(_raw) AS failed_attempts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip
13+
| where failed_attempts > 10
14+
| `high_number_of_login_failures_from_a_single_source_filter`'
15+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Adjust the threshold value to suit the specific environment, as environments with naturally higher login failures might generate false positives at a lower threshold.
16+
known_false_positives: An Ip address with more than 10 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
17+
references:
18+
- https://attack.mitre.org/techniques/T1110/001/
19+
- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
20+
- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
21+
- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
2022
tags:
2123
analytic_story:
22-
- Office 365 Detections
24+
- Office 365 Account Takeover
2325
asset_type: Office 365
2426
confidence: 50
2527
impact: 50
26-
message: tbd
28+
message: Ip address $src_ip$ failed to authenticate more than 10 times in a 5 minute
2729
mitre_attack_id:
2830
- T1110.001
2931
- T1110
@@ -32,6 +34,10 @@ tags:
3234
type: User
3335
role:
3436
- Victim
37+
- name: src_ip
38+
type: IP Address
39+
role:
40+
- Attacker
3541
product:
3642
- Splunk Enterprise
3743
- Splunk Enterprise Security
@@ -53,6 +59,6 @@ tags:
5359
tests:
5460
- name: True Positive Test
5561
attack_data:
56-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/high_number_of_login_failures_from_a_single_source.json
57-
sourcetype: o365:management:activity
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/o365_high_number_authentications_for_user.log
5863
source: o365
64+
sourcetype: o365:management:activity

‎detections/cloud/o365_add_app_role_assignment_grant_user.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ references:
2525
- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
2626
tags:
2727
analytic_story:
28-
- Office 365 Detections
28+
- Office 365 Persistence Mechanisms
2929
- Cloud Federated Credential Abuse
3030
asset_type: Office 365
3131
confidence: 60

‎detections/cloud/o365_added_service_principal.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ references:
2020
- https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack?hsLang=en
2121
tags:
2222
analytic_story:
23-
- Office 365 Detections
23+
- Office 365 Persistence Mechanisms
2424
- Cloud Federated Credential Abuse
2525
asset_type: Office 365
2626
confidence: 60

0 commit comments

Comments
 (0)