From ff4a48009fdab0e5a7485796a8f24c719136f3a6 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Mon, 6 Jan 2025 11:08:54 -0500 Subject: [PATCH 1/8] Add files via upload --- ...ows_system_remote_discovery_with_query.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 detections/endpoint/windows_system_remote_discovery_with_query.yml diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml new file mode 100644 index 0000000000..7e021937b8 --- /dev/null +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -0,0 +1,57 @@ +name: Windows System Remote Discovery With Query +id: 94859172-a521-474f-97ac-4cf4b09634a3 +version: 1 +date: '2025-01-06' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network. +data_source: +- Sysmon Event ID 1 +- Windows Security Event ID 4688 +search: '| tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_system_remote_discovery_with_query_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1033/ +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 75 + impact: 60 + message: The user $user$ ran the Query command on a remote system from $dest$ + mitre_attack_id: + - T1033 + observable: + - name: dest + type: System + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_name + - Processes.parent_process_name + risk_score: 45 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file From ec2cd5dd8092cde814253fe127bc0fb0f33bd218 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 7 Jan 2025 15:52:52 -0500 Subject: [PATCH 2/8] Update detections/endpoint/windows_system_remote_discovery_with_query.yml Good suggestion Co-authored-by: Nasreddine Bencherchali --- .../endpoint/windows_system_remote_discovery_with_query.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index 7e021937b8..1fd676d28e 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -4,7 +4,8 @@ version: 1 date: '2025-01-06' author: Steven Dick status: production -type: TTP +type: Anomaly + description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network. data_source: - Sysmon Event ID 1 From 24aae81793668e0474e1764fbd62e8f5c6e79cc1 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 7 Jan 2025 15:53:10 -0500 Subject: [PATCH 3/8] Update detections/endpoint/windows_system_remote_discovery_with_query.yml EID updates Co-authored-by: Nasreddine Bencherchali --- .../endpoint/windows_system_remote_discovery_with_query.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index 1fd676d28e..70fd734d54 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -10,6 +10,7 @@ description: The following analytic detects the execution of `query.exe` with co data_source: - Sysmon Event ID 1 - Windows Security Event ID 4688 +- CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` From 88ca4c4f071d9d73ad357400b1f24705c2186738 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 7 Jan 2025 15:54:22 -0500 Subject: [PATCH 4/8] Apply suggestions from code review Bulk commit on risk score and grammar Co-authored-by: Nasreddine Bencherchali --- .../windows_system_remote_discovery_with_query.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index 70fd734d54..0317666616 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -24,9 +24,12 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - confidence: 75 - impact: 60 - message: The user $user$ ran the Query command on a remote system from $dest$ + confidence: 49 + + impact: 49 + + message: The user $user$ ran the Query command to query information from a remote system from $dest$ + mitre_attack_id: - T1033 observable: @@ -49,7 +52,8 @@ tags: - Processes.process - Processes.process_name - Processes.parent_process_name - risk_score: 45 + risk_score: 24 + security_domain: endpoint tests: - name: True Positive Test From a5b77ca3a515840c76a08a00cd1adda2ed9d297a Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 7 Jan 2025 15:58:11 -0500 Subject: [PATCH 5/8] Update windows_system_remote_discovery_with_query.yml Updating with drilldowns --- ...ows_system_remote_discovery_with_query.yml | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index 0317666616..e25dc7c28a 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -5,7 +5,6 @@ date: '2025-01-06' author: Steven Dick status: production type: Anomaly - description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network. data_source: - Sysmon Event ID 1 @@ -20,16 +19,26 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate processes on $dest$ + search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name|s$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint confidence: 49 - impact: 49 - message: The user $user$ ran the Query command to query information from a remote system from $dest$ - mitre_attack_id: - T1033 observable: @@ -53,11 +62,10 @@ tags: - Processes.process_name - Processes.parent_process_name risk_score: 24 - security_domain: endpoint tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From 104e187eb1cb22b972f30020feff7fea66f8e97c Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 08:18:26 -0500 Subject: [PATCH 6/8] Update windows_system_remote_discovery_with_query.yml observables update --- .../endpoint/windows_system_remote_discovery_with_query.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index e25dc7c28a..9b222b63ca 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -43,7 +43,7 @@ tags: - T1033 observable: - name: dest - type: System + type: Hostname role: - Victim - name: user From 5b9b5ab07b3945aedfc30e69e81f174752047a3a Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Sun, 2 Feb 2025 12:49:10 -0500 Subject: [PATCH 7/8] Update windows_system_remote_discovery_with_query.yml update to v5 yaml spec update search yaml for better readability / remove single quote in SPL issues --- ...ows_system_remote_discovery_with_query.yml | 43 ++++++++----------- 1 file changed, 18 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index 9b222b63ca..b432d2b97f 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -10,11 +10,12 @@ data_source: - Sysmon Event ID 1 - Windows Security Event ID 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `windows_system_remote_discovery_with_query_filter`' +search: |- + | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_system_remote_discovery_with_query_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: @@ -32,36 +33,28 @@ drilldown_searches: search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name|s$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: The user $user$ ran the Query command to enumerate the remote system $dest$ + risk_objects: + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - confidence: 49 - impact: 49 - message: The user $user$ ran the Query command to query information from a remote system from $dest$ mitre_attack_id: - T1033 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.process - - Processes.process_name - - Processes.parent_process_name - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test From 7ebb49e63cda7a59eb0ece265b915ae334e5d3b4 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 5 Feb 2025 22:01:51 +0100 Subject: [PATCH 8/8] update logic to avoid duplicate alerting --- detections/endpoint/system_user_discovery_with_query.yml | 9 ++++----- .../windows_system_remote_discovery_with_query.yml | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 249c62b457..cd0788aeb9 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -1,7 +1,7 @@ name: System User Discovery With Query id: ad03bfcf-8a91-4bc2-a500-112993deba87 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-02-05' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -17,9 +17,8 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe") - (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") + AND Processes.process="*user*" AND ((NOT Processes.process="*/server*") OR Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_query_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index b432d2b97f..58b97c3df7 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -1,7 +1,7 @@ name: Windows System Remote Discovery With Query id: 94859172-a521-474f-97ac-4cf4b09634a3 version: 1 -date: '2025-01-06' +date: '2025-02-05' author: Steven Dick status: production type: Anomaly @@ -11,7 +11,7 @@ data_source: - Windows Security Event ID 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name + | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process="*/server*") AND NOT Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*") by Processes.dest Processes.user Processes.process_name Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`