Skip to content

Commit 58a6e70

Browse files
pyth0n1cpyth0n1c
authored
Merge branch 'develop' into new-rules
2 parents 4f0bbc2 + 292fba5 commit 58a6e70

12 files changed

+219
-27
lines changed

‎detections/cloud/o365_exfiltration_via_file_access.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: O365 Exfiltration via File Access
2+
id: 80b44ae2-60ff-43f1-8e56-34beb49a340a
3+
version: 1
4+
date: '2024-10-14'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when an excessive number of files are access from o365 by the same user over a short period of time. A malicious actor may abuse the "open in app" functionality of SharePoint through scripted or Graph API based access to evade triggering the FileDownloaded Event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be take with any Azure Guest (#EXT#) accounts.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Operation IN ("fileaccessed") UserId!=app@sharepoint NOT SourceFileExtension IN (bmp,png,jpeg,jpg)
13+
| eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
14+
| where NOT match(SiteUrl,user_flat)
15+
| stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
16+
| eventstats avg(count) as avg stdev(count) as stdev by Workload
17+
| rename SiteUrl as file_path,Workload as app
18+
| where count > 50 AND count > (avg + (3*(stdev)))
19+
| `security_content_ctime(firstTime)`
20+
| `security_content_ctime(lastTime)`
21+
| `o365_exfiltration_via_file_access_filter`
22+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
23+
known_false_positives: It is possible that certain file access scenarios may trigger this alert, specifically OneDrive syncing and users accessing personal onedrives of other users. Adjust threshold and filtering as needed.
24+
references:
25+
- https://attack.mitre.org/techniques/T1567/exfil
26+
- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
27+
- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
28+
drilldown_searches:
29+
- name: View the detection results for - "$user$"
30+
search: '%original_detection_search% | search user = "$user$"'
31+
earliest_offset: $info_min_time$
32+
latest_offset: $info_max_time$
33+
- name: View risk events for the last 7 days for - "$user$"
34+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
- name: Investigate file access by $user$
38+
search: '`o365_management_activity` Operation IN ("fileaccessed") UserId="$UserId$"'
39+
earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
rba:
42+
message: The user $user$ accessed an excessive number of files [$count$] from $file_path$ using $src$
43+
risk_objects:
44+
- field: user
45+
type: user
46+
score: 20
47+
threat_objects:
48+
- field: src
49+
type: ip_address
50+
tags:
51+
analytic_story:
52+
- Data Exfiltration
53+
- Office 365 Account Takeover
54+
asset_type: O365 Tenant
55+
mitre_attack_id:
56+
- T1567
57+
- T1530
58+
product:
59+
- Splunk Enterprise
60+
- Splunk Enterprise Security
61+
- Splunk Cloud
62+
security_domain: threat
63+
tests:
64+
- name: True Positive Test
65+
attack_data:
66+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
67+
source: o365
68+
sourcetype: o365:management:activity

‎detections/cloud/o365_exfiltration_via_file_download.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: O365 Exfiltration via File Download
2+
id: 06b23921-bfe2-4576-89dd-616f06e129da
3+
version: 1
4+
date: '2024-10-14'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when an excessive number of files are downloaded from o365 by the same user over a short period of time. O365 may bundle these files together as a ZIP file, however each file will have it's own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Operation IN ("filedownloaded")
13+
| eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
14+
| stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
15+
| rename SiteUrl as file_path,Workload as app
16+
| where count > 50
17+
| `security_content_ctime(firstTime)`
18+
| `security_content_ctime(lastTime)`
19+
| `o365_exfiltration_via_file_download_filter`
20+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
21+
known_false_positives: It is possible that certain file download scenarios may trigger this alert, specifically OneDrive syncing. Adjust threshold and filtering as needed.
22+
references:
23+
- https://attack.mitre.org/techniques/T1567/exfil
24+
- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
25+
- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
26+
drilldown_searches:
27+
- name: View the detection results for - "$user$"
28+
search: '%original_detection_search% | search user = "$user$"'
29+
earliest_offset: $info_min_time$
30+
latest_offset: $info_max_time$
31+
- name: View risk events for the last 7 days for - "$user$"
32+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: Investigate file downloads by $user$
36+
search: '`o365_management_activity` Operation IN ("filedownloaded") UserId="$UserId$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
rba:
40+
message: The user $user$ downloaded an excessive number of files [$count$] from $file_path$ using $src$
41+
risk_objects:
42+
- field: user
43+
type: user
44+
score: 25
45+
threat_objects:
46+
- field: src
47+
type: ip_address
48+
tags:
49+
analytic_story:
50+
- Data Exfiltration
51+
- Office 365 Account Takeover
52+
asset_type: O365 Tenant
53+
mitre_attack_id:
54+
- T1567
55+
- T1530
56+
product:
57+
- Splunk Enterprise
58+
- Splunk Enterprise Security
59+
- Splunk Cloud
60+
security_domain: threat
61+
tests:
62+
- name: True Positive Test
63+
attack_data:
64+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
65+
source: o365
66+
sourcetype: o365:management:activity

‎detections/cloud/o365_exfiltration_via_file_sync_download.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: O365 Exfiltration via File Sync Download
2+
id: 350837b5-13d3-4c06-b688-db07afbe5050
3+
version: 1
4+
date: '2024-10-14'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when an excessive number of files are sync from o365 by the same user over a short period of time. A malicious actor abuse the user-agent string through GUI or API access to evade triggering the FileDownloaded event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Operation IN ("filesyncdownload*") UserAgent="*SkyDriveSync*"
13+
| eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
14+
| where NOT match(SiteUrl,user_flat)
15+
| stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
16+
| rename SiteUrl as file_path,Workload as app
17+
| where count > 50
18+
| `security_content_ctime(firstTime)`
19+
| `security_content_ctime(lastTime)`
20+
| `o365_exfiltration_via_file_sync_download_filter`
21+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
22+
known_false_positives: It is possible that certain file sync scenarios may trigger this alert, specifically OneNote. Adjust threshold and filtering as needed.
23+
references:
24+
- https://attack.mitre.org/techniques/T1567/exfil
25+
- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
26+
- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
27+
drilldown_searches:
28+
- name: View the detection results for - "$user$"
29+
search: '%original_detection_search% | search user = "$user$"'
30+
earliest_offset: $info_min_time$
31+
latest_offset: $info_max_time$
32+
- name: View risk events for the last 7 days for - "$user$"
33+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: Investigate file sync downloads by $user$
37+
search: '`o365_management_activity` Operation IN ("filesyncdownload*") UserId="$UserId$"'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
rba:
41+
message: The user $user$ synced an excessive number of files [$count$] from $file_path$ using $src$
42+
risk_objects:
43+
- field: user
44+
type: user
45+
score: 25
46+
threat_objects:
47+
- field: src
48+
type: ip_address
49+
tags:
50+
analytic_story:
51+
- Data Exfiltration
52+
- Office 365 Account Takeover
53+
asset_type: O365 Tenant
54+
mitre_attack_id:
55+
- T1567
56+
- T1530
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
security_domain: threat
62+
tests:
63+
- name: True Positive Test
64+
attack_data:
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
66+
source: o365
67+
sourcetype: o365:management:activity

‎detections/endpoint/chcp_command_execution.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: CHCP Command Execution
22
id: 21d236ec-eec1-11eb-b23e-acde48001122
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of the chcp.exe applic
1515
system compromise and data exfiltration.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com

‎detections/endpoint/jscript_execution_using_cscript_app.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Jscript Execution Using Cscript App
22
id: 002f1e24-146e-11ec-a470-acde48001122
3-
version: 5
4-
date: '2025-02-10'
3+
version: 6
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -14,7 +14,6 @@ description: The following analytic detects the execution of JScript using the c
1414
scripts, leading to code execution, data exfiltration, or further system compromise.
1515
data_source:
1616
- Sysmon EventID 1
17-
- Windows Event Log Security 4688
1817
- CrowdStrike ProcessRollup2
1918
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2019
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name

‎detections/endpoint/ping_sleep_batch_command.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Ping Sleep Batch Command
22
id: ce058d6c-79f2-11ec-b476-acde48001122
3-
version: 6
4-
date: '2025-02-10'
3+
version: 7
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -15,7 +15,6 @@ description: The following analytic identifies the execution of ping sleep batch
1515
exfiltration.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process

‎detections/endpoint/vbscript_execution_using_wscript_app.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Vbscript Execution Using Wscript App
22
id: 35159940-228f-11ec-8a49-acde48001122
3-
version: 5
4-
date: '2025-02-10'
3+
version: 6
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of VBScript using the
1515
data exfiltration, or further lateral movement within the network.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name

‎detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Command Shell DCRat ForkBomb Payload
22
id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1
3-
version: 6
4-
date: '2025-02-10'
3+
version: 7
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of a DCRat "forkbomb"
1515
disruption of services.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
2120
values(Processes.parent_process) as parent_process values(Processes.parent_process_id)

‎detections/endpoint/windows_indirect_command_execution_via_forfiles.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Indirect Command Execution Via forfiles
22
id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Eric McGinnis, Splunk
66
status: production
77
type: TTP
@@ -16,7 +16,6 @@ description: The following analytic detects the execution of programs initiated
1616
compromise.
1717
data_source:
1818
- Sysmon EventID 1
19-
- Windows Event Log Security 4688
2019
- CrowdStrike ProcessRollup2
2120
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2221
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles*

‎detections/endpoint/windows_indirect_command_execution_via_pcalua.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Indirect Command Execution Via pcalua
22
id: 3428ac18-a410-4823-816c-ce697d26f7a8
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Eric McGinnis, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects programs initiated by pcalua.exe, th
1515
environment.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua*

0 commit comments

Comments
 (0)