You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The following correlation will take risk associated with the content
10
-
from "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories and
11
-
tally it up. Once it hits the threshold of 100 (can be changed), it will trigger an a notable. As needed, reduce or raise the risk scores assocaited with the anomaly and TTP analytics tagged to these two analytic stories.
9
+
This correlation computes the risk events associated with the detection analytics from "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" analytic stories. This analytic will trigger a notable event in your incident review when there are 5 or more distinct TTPs related to these analytic stories in the last 24 hours. This incident highlights potentially suspicious activity by a compromised user.
12
10
data_source: []
13
11
search:
14
-
'| tstats `security_content_summariesonly` sum(All_Risk.calculated_risk_score) as risk_score,
15
-
count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id)
16
-
as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id)
17
-
as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id)
18
-
as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id)
19
-
as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source,
20
-
dc(source) as source_count from datamodel=Risk.All_Risk by All_Risk.risk_object,All_Risk.risk_object_type
'| tstats `security_content_summariesonly` values(All_Risk.analyticstories) as analyticstories sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.risk_object_type = user All_Risk.analyticstories IN ("Okta Account Takeover", "Suspicious Okta Activity","Okta MFA Exhaustion") by All_Risk.risk_object,All_Risk.risk_object_type | `drop_dm_object_name("All_Risk")` | search mitre_technique_id_count > 5 | `okta_risk_threshold_exceeded_filter`'
25
13
how_to_implement:
26
-
Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic
27
-
stories are enabled. TTP may be set to Notables for point detections, anomaly should
28
-
not be notables but risk generators. The correlation relies on risk before generating
29
-
a notable. Modify the value as needed. Default threshold is 100. This value may
30
-
need to be increased based on activity in your environment.
14
+
This search leverages the Risk Framework from Enterprise Security. Ensure that "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" analytic stories are enabled. TTPs may be set to Notables for point detections; anomalies should not be notables but rather risk generators. The correlation relies on risk before generating a notable. Modify the value as needed.
31
15
known_false_positives:
32
-
False positives will be limited to the amount of events generated
33
-
by the analytics tied to the stories. Analytics will need to be tesetd and tuned,
34
-
risk score reduced, as needed based on organization.
16
+
False positives will be limited to the number of events generated by the analytics tied to the stories. Analytics will need to be tested and tuned, and the risk score reduced as needed based on the organization.
Copy file name to clipboardExpand all lines: detections/application/windows_ad_add_self_to_group.yml
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -6,16 +6,15 @@ author: Dean Luxton
6
6
status: production
7
7
type: TTP
8
8
data_source:
9
-
- UPDATE_DATA_SOURCE
9
+
- Windows Event Log Security 4728
10
10
description: Detect when a user adds themselfs to an AD Group.
11
11
search: '`wineventlog_security` EventCode IN (4728)
12
12
| where user=src_user
13
13
| stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user
14
14
| `windows_ad_add_self_to_group_filter`'
15
15
how_to_implement: This analytic requires eventCode 4728 to be ingested.
Copy file name to clipboardExpand all lines: detections/endpoint/detect_new_local_admin_account.yml
+10-13Lines changed: 10 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,18 @@
1
1
name: Detect New Local Admin account
2
2
id: b25f6f62-0712-43c1-b203-083231ffd97d
3
-
version: 2
4
-
date: '2020-07-08'
3
+
version: 4
4
+
date: '2024-06-25'
5
5
author: David Dorsey, Splunk
6
6
status: production
7
7
type: TTP
8
8
description: |-
9
9
The following analytic detects the creation of new accounts that have been elevated to local administrators so that you can take immediate action to mitigate the risks and prevent further unauthorized access or malicious activities. This detection is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) to search for relevant security events in the Windows event log. When a new account is created or an existing account is added to the Administrators group, this analytic identifies this behavior by looking for EventCode 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled global group). This analytic specifically focuses on events where the Group_Name is set to Administrators. This detection is important because it suggests that an attacker has gained elevated privileges and can perform malicious actions with administrative access. This can lead to significant impact, such as unauthorized access to sensitive data, unauthorized modifications to systems or configurations, and potential disruption of critical services. identifying this behavior is crucial for a Security Operations Center (SOC). Next steps include reviewing the details of the security event, including the user account that was created or added to the Administrators group. Also, examine the time span between the first and last occurrence of the event to determine if the behavior is ongoing. Additionally, consider any contextual information, such as the destination where the account was created or added to understand the scope and potential impact of the attack.
10
10
data_source:
11
-
- Windows Security 4732
12
-
- Windows Security 4720
11
+
- Windows Event Log Security 4732
12
+
- Windows Event Log Security 4720
13
13
search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators)
14
14
| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest
15
-
| where evCount=2 AND duration<7200
15
+
| where evCount=2
16
16
| fields - evCount, duration
17
17
| `detect_new_local_admin_account_filter`'
18
18
how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
0 commit comments