Skip to content

Commit e6fb279

Browse files
committed
updating detections
1 parent 1d98293 commit e6fb279

5 files changed

+65
-67
lines changed
Lines changed: 23 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,37 @@
11
name: Okta Risk Threshold Exceeded
22
id: d8b967dd-657f-4d88-93b5-c588bcd7218c
3-
version: 1
4-
date: "2022-09-29"
5-
author: Michael Haag, Splunk
3+
version: 2
4+
date: "2024-04-02"
5+
author: Michael Haag, Bhavin Patel, Splunk
66
status: production
77
type: Correlation
88
description:
9-
The following correlation will take risk associated with the content
10-
from "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories and
11-
tally it up. Once it hits the threshold of 100 (can be changed), it will trigger an a notable. As needed, reduce or raise the risk scores assocaited with the anomaly and TTP analytics tagged to these two analytic stories.
9+
This correlation computes the risk events associated with the detection analytics from "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" analytic stories. This analytic will trigger a notable event in your incident review when there are 5 or more distinct TTPs related to these analytic stories in the last 24 hours. This incident highlights potentially suspicious activity by a compromised user.
1210
data_source: []
1311
search:
14-
'| tstats `security_content_summariesonly` sum(All_Risk.calculated_risk_score) as risk_score,
15-
count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id)
16-
as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id)
17-
as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id)
18-
as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id)
19-
as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source,
20-
dc(source) as source_count from datamodel=Risk.All_Risk by All_Risk.risk_object,All_Risk.risk_object_type
21-
All_Risk.analyticstories | `drop_dm_object_name("All_Risk")` | eval "annotations.mitre_attack"="annotations.mitre_attack.mitre_technique_id",
22-
risk_threshold=100 | where analyticstories IN ("Suspicious Okta Activity",
23-
"Okta MFA Exhaustion") risk_score > risk_threshold | `get_risk_severity(risk_score)`
24-
| `okta_risk_threshold_exceeded_filter`'
12+
'| tstats `security_content_summariesonly` values(All_Risk.analyticstories) as analyticstories sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.risk_object_type = user All_Risk.analyticstories IN ("Okta Account Takeover", "Suspicious Okta Activity","Okta MFA Exhaustion") by All_Risk.risk_object,All_Risk.risk_object_type | `drop_dm_object_name("All_Risk")` | search mitre_technique_id_count > 5 | `okta_risk_threshold_exceeded_filter`'
2513
how_to_implement:
26-
Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic
27-
stories are enabled. TTP may be set to Notables for point detections, anomaly should
28-
not be notables but risk generators. The correlation relies on risk before generating
29-
a notable. Modify the value as needed. Default threshold is 100. This value may
30-
need to be increased based on activity in your environment.
14+
This search leverages the Risk Framework from Enterprise Security. Ensure that "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" analytic stories are enabled. TTPs may be set to Notables for point detections; anomalies should not be notables but rather risk generators. The correlation relies on risk before generating a notable. Modify the value as needed.
3115
known_false_positives:
32-
False positives will be limited to the amount of events generated
33-
by the analytics tied to the stories. Analytics will need to be tesetd and tuned,
34-
risk score reduced, as needed based on organization.
16+
False positives will be limited to the number of events generated by the analytics tied to the stories. Analytics will need to be tested and tuned, and the risk score reduced as needed based on the organization.
3517
references:
3618
- https://developer.okta.com/docs/reference/api/event-types
3719
- https://sec.okta.com/everythingisyes
3820
tags:
3921
analytic_story:
40-
- Suspicious Okta Activity
22+
- Okta Account Takeover
4123
- Okta MFA Exhaustion
42-
asset_type: Infrastructure
24+
- Suspicious Okta Activity
25+
asset_type: Okta Tenant
4326
confidence: 80
4427
impact: 70
45-
message: Risk score $risk_score$ threshold exceeded for $risk_object$ related to Okta events.
28+
message: Okta Risk threshold exceeded for user [$risk_object$]. Investigate further to determine if this was authorized.
4629
mitre_attack_id:
4730
- T1078
4831
- T1110
4932
observable:
5033
- name: risk_object
51-
type: Hostname
34+
type: User
5235
role:
5336
- Victim
5437
product:
@@ -59,5 +42,16 @@ tags:
5942
- All_Risk.risk_object
6043
- All_Risk.risk_object_type
6144
- All_Risk.analyticstories
45+
- All_Risk.calculated_risk_score
46+
- All_Risk.annotations.mitre_attack.mitre_tactic_id
47+
- All_Risk.annotations.mitre_attack.mitre_technique_id
48+
- All_Risk.tag
49+
- _time
6250
risk_score: 56
6351
security_domain: access
52+
tests:
53+
- name: True Positive Test
54+
attack_data:
55+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/okta_account_takeover_risk_events/okta_risk.log
56+
source: risk_data
57+
sourcetype: stash

detections/application/windows_ad_add_self_to_group.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,15 @@ author: Dean Luxton
66
status: production
77
type: TTP
88
data_source:
9-
- UPDATE_DATA_SOURCE
9+
- Windows Event Log Security 4728
1010
description: Detect when a user adds themselfs to an AD Group.
1111
search: '`wineventlog_security` EventCode IN (4728)
1212
| where user=src_user
1313
| stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user
1414
| `windows_ad_add_self_to_group_filter`'
1515
how_to_implement: This analytic requires eventCode 4728 to be ingested.
1616
known_false_positives: Unknown
17-
references:
18-
- REFERENCE
17+
references: []
1918
tags:
2019
analytic_story:
2120
- Active Directory Privilege Escalation
@@ -46,6 +45,7 @@ tags:
4645
tests:
4746
- name: True Positive Test
4847
attack_data:
49-
- data: UPDATE url to dataset
50-
source: UPDATE source
51-
sourcetype: UPDATE sourcetype
48+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
49+
source: XmlWinEventLog:Security
50+
sourcetype: XmlWinEventLog
51+
update_timestamp: true

detections/endpoint/detect_new_local_admin_account.yml

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
name: Detect New Local Admin account
22
id: b25f6f62-0712-43c1-b203-083231ffd97d
3-
version: 2
4-
date: '2020-07-08'
3+
version: 4
4+
date: '2024-06-25'
55
author: David Dorsey, Splunk
66
status: production
77
type: TTP
88
description: |-
99
The following analytic detects the creation of new accounts that have been elevated to local administrators so that you can take immediate action to mitigate the risks and prevent further unauthorized access or malicious activities. This detection is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) to search for relevant security events in the Windows event log. When a new account is created or an existing account is added to the Administrators group, this analytic identifies this behavior by looking for EventCode 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled global group). This analytic specifically focuses on events where the Group_Name is set to Administrators. This detection is important because it suggests that an attacker has gained elevated privileges and can perform malicious actions with administrative access. This can lead to significant impact, such as unauthorized access to sensitive data, unauthorized modifications to systems or configurations, and potential disruption of critical services. identifying this behavior is crucial for a Security Operations Center (SOC). Next steps include reviewing the details of the security event, including the user account that was created or added to the Administrators group. Also, examine the time span between the first and last occurrence of the event to determine if the behavior is ongoing. Additionally, consider any contextual information, such as the destination where the account was created or added to understand the scope and potential impact of the attack.
1010
data_source:
11-
- Windows Security 4732
12-
- Windows Security 4720
11+
- Windows Event Log Security 4732
12+
- Windows Event Log Security 4720
1313
search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators)
1414
| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest
15-
| where evCount=2 AND duration<7200
15+
| where evCount=2
1616
| fields - evCount, duration
1717
| `detect_new_local_admin_account_filter`'
1818
how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
@@ -36,7 +36,10 @@ tags:
3636
- T1136.001
3737
- T1136
3838
observable:
39-
- name: user
39+
- name: src_user
40+
type: User
41+
role:
42+
- Victim
4043
type: User
4144
role:
4245
- Victim
@@ -63,15 +66,9 @@ tests:
6366
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
6467
source: WinEventLog:Security
6568
sourcetype: WinEventLog
66-
update_timestamp: true
6769
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
6870
source: WinEventLog:System
6971
sourcetype: WinEventLog
70-
update_timestamp: true
7172
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
7273
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
73-
sourcetype: xmlwineventlog
74-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log
75-
source: XmlWinEventLog:Security
76-
sourcetype: XmlWinEventLog
77-
update_timestamp: true
74+
sourcetype: xmlwineventlog

detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
22
id: 0cb847ee-9423-11ec-b2df-acde48001122
3-
version: 1
4-
date: '2022-02-22'
3+
version: 2
4+
date: '2024-06-25'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -13,7 +13,7 @@ description: The following analytic leverages Windows Security Event 4738, `A us
1313
Red Teams and adversaries alike who have obtained privileges in an Active Directory
1414
network may use this technique as a backdoor or a way to escalate privileges.
1515
data_source:
16-
- Windows Security 4738
16+
- Windows Event Log Security 4738
1717
search: ' `wineventlog_security` EventCode=4738 (UserAccountControl="%%2096" OR MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*")
1818
| eval MSADChangedAttributes="''Don''t Require Preauth'' - Enabled"
1919
| table _time, source, EventCode, src_user, src_user_category, user, user_category, MSADChangedAttributes
@@ -29,7 +29,7 @@ references:
2929
tags:
3030
analytic_story:
3131
- Active Directory Kerberos Attacks
32-
asset_type: endpoint
32+
asset_type: Endpoint
3333
confidence: 90
3434
impact: 50
3535
message: Kerberos Pre Authentication was Disabled for $user$
@@ -59,4 +59,4 @@ tests:
5959
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
6060
source: WinEventLog:Security
6161
sourcetype: WinEventLog
62-
update_timestamp: true
62+
update_timestamp: true

detections/endpoint/macos_plutil.yml

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
11
name: MacOS plutil
22
id: c11f2b57-92c1-4cd2-b46c-064eafb833ac
3-
version: 2
4-
date: '2022-05-26'
3+
version: 4
4+
date: '2024-05-22'
55
author: Patrick Bareiss, Splunk
66
status: production
77
type: TTP
8-
description: Detect usage of plutil to modify plist files. Adversaries can Modify plist
9-
files to executed binaries or add command line arguments. Plist files in auto-run
10-
locations are executed upon user logon or system startup.
11-
data_source: []
8+
description: The following analytic detects the usage of the `plutil` command to modify
9+
plist files on macOS systems. It leverages osquery to monitor process events, specifically
10+
looking for executions of `/usr/bin/plutil`. This activity is significant because
11+
adversaries can use `plutil` to alter plist files, potentially adding malicious
12+
binaries or command-line arguments that execute upon user logon or system startup.
13+
If confirmed malicious, this could allow attackers to achieve persistence, execute
14+
arbitrary code, or escalate privileges, posing a significant threat to the system's
15+
security.
16+
data_source:
17+
- osquery
1218
search: '`osquery` name=es_process_events columns.path=/usr/bin/plutil | rename columns.*
1319
as * | stats count min(_time) as firstTime max(_time) as lastTime by username host
14-
cmdline pid path parent signing_id | rename username as User, cmdline as process,
15-
path as process_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
20+
cmdline pid path parent signing_id | rename username as user, cmdline as process,
21+
path as process_path, host as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
1622
| `macos_plutil_filter`'
1723
how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow
1824
the link in references, which describes how to setup process auditing in MacOS with
@@ -26,18 +32,18 @@ tags:
2632
asset_type: Endpoint
2733
confidence: 50
2834
impact: 50
29-
message: plutil are executed on $host$ from $user$
35+
message: plutil are executed on $dest$ from $user$
3036
mitre_attack_id:
3137
- T1647
3238
observable:
3339
- name: user
3440
type: User
3541
role:
3642
- Victim
37-
- name: process
38-
type: Process
43+
- name: dest
44+
type: Hostname
3945
role:
40-
- Child Process
46+
- Victim
4147
product:
4248
- Splunk Enterprise
4349
- Splunk Enterprise Security
@@ -56,6 +62,7 @@ tags:
5662
tests:
5763
- name: True Positive Test
5864
attack_data:
59-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1647/atomic_red_team/osquery.log
65+
- data:
66+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1647/atomic_red_team/osquery.log
6067
source: osquery
61-
sourcetype: osquery:results
68+
sourcetype: osquery:results

0 commit comments

Comments
 (0)